Generating state-on-state data for hierarchical clusters in a three-dimensional model representing machine data

ABSTRACT

Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object&#39;s data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of co-pending U.S. Patent Applicationtitled, “CONVEYING STATE-ON-STATE DATA TO A USER VIA HIERARCHICALCLUSTERS IN A THREE-DIMENSIONAL MODEL,” filed Apr. 26, 2017 and havingSer. No. 15/498,436, which is a continuation of co-pending U.S. PatentApplication titled, “SYSTEMS AND METHODS FOR USING A THREE-DIMENSIONAL,FIRST PERSON DISPLAY TO CONVEY DATA TO A USER,” filed Apr. 30, 2014 andhaving Ser. No. 14/266,523, which claims priority benefit of the UnitedStates Provisional Patent Application titled “SYSTEMS AND METHODS FORUSING A THREE-DIMENSIONAL, FIRST PERSON DISPLAY TO CONVEY DATA TO AUSER,” filed Jul. 31, 2013 and having Ser. No. 61/860,895. The subjectmatter of these related applications is hereby incorporated herein byreference.

TECHNOLOGY

The present invention relates generally to information systems, and inparticular, to generating state-on-state data for hierarchical clustersin a three-dimensional model representing.

BACKGROUND

Information systems generate vast amounts of information from which itcan be difficult to extract particular data that is important to theuser. Although the development of computers and software has beenstaggering in many ways, existing computer systems are still limited intheir capacity to convey large amounts of data in a way that users candigest and understand quickly. Because the amount of relevant data thatis available for analysis continues to increase significantly from yearto year, the need for improved tools for communicating such data tousers is becoming urgent.

The approaches described in this section are approaches that could bepursued, but not necessarily approaches that have been previouslyconceived or pursued. Therefore, unless otherwise indicated, it shouldnot be assumed that any of the approaches described in this sectionqualify as prior art merely by virtue of their inclusion in thissection. Similarly, issues identified with respect to one or moreapproaches should not assume to have been recognized in any prior art onthe basis of this section, unless otherwise indicated.

BRIEF DESCRIPTION OF DRAWINGS

The present invention is illustrated by way of example, and not by wayof limitation, in the figures of the accompanying drawings and in whichlike reference numerals refer to similar elements and in which:

FIG. 1 is a block diagram of a data display system in accordance with anembodiment of the present system;

FIG. 2 is a chart of example node attributes and the data to which theattributes correspond, according to a particular embodiment;

FIG. 3A and FIG. 3B depict flow charts that generally illustrate varioussteps executed by a data display module and a display module,respectively, that, for example, may be executed by the Data DisplayServer of FIG. 1;

FIG. 4 is a screen display showing example nodes and the data to whichthe nodes correspond;

FIG. 5 is a screen display depicting example cluster designators;

FIG. 6, FIG. 7 and FIG. 8 are screen displays of example interfaceswhich users may use to access the system;

FIG. 9 is an example interface showing a tracing feature of the system;

FIG. 10 is a block diagram illustrating a system for collecting andsearching unstructured time stamped events;

FIG. 11 is a schematic diagram of a computer, such as the data displayserver of FIG. 1 that is suitable for use in various embodiments; and

FIG. 12 illustrates an example process flow.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Example embodiments, which relate to extracting and viewing data, aredescribed herein. In the following description, for the purposes ofexplanation, numerous specific details are set forth in order to providea thorough understanding of the present invention. It will be apparent,however, that the present invention may be practiced without thesespecific details. In other instances, well-known structures and devicesare not described in exhaustive detail, in order to avoid unnecessarilyoccluding, obscuring, or obfuscating the present invention.

Example embodiments are described herein according to the followingoutline:

-   -   1. GENERAL OVERVIEW    -   2. STRUCTURE OVERVIEW    -   3. SETUP MODULE    -   4. DISPLAY MODULE    -   5. EXAMPLE THREE-DIMENSIONAL ENVIRONMENTS    -   6. NODES    -   7. CLUSTER DESIGNATORS    -   8. HIERARCHIES OF COMPONENTS    -   9. MULTIPLE USERS    -   10. MARKING OF NODES    -   11. RECORD AND PLAYBACK    -   12. DYNAMIC NATURE OF DATA    -   13. DATA TRACING    -   14. EXAMPLE DATA SOURCES    -   15. EXAMPLE SYSTEM OPERATION    -   16. EXAMPLE DATA COLLECTION SYSTEM    -   17. ADDITIONAL TECHNICAL DETAILS    -   18. EXAMPLE PROCESS FLOW    -   19. EXAMPLE SYSTEM ARCHITECTURE    -   20. EQUIVALENTS, EXTENSIONS, ALTERNATIVES AND MISCELLANEOUS        1. General Overview

This overview presents a basic description of some aspects ofembodiment(s) of the present invention. It should be noted that thisoverview is not an extensive or exhaustive summary of aspects of theembodiment. Moreover, it should be noted that this overview is notintended to be understood as identifying any particularly significantaspects or elements of the embodiment(s), nor as delineating any scopeof the embodiment(s) in particular, nor the invention in general. Thisoverview merely presents some concepts that relate to exampleembodiments in a condensed and simplified format, and should beunderstood as merely a conceptual prelude to a more detailed descriptionof example embodiments that follows below.

A computer system, according to various embodiments, is adapted to allowa user to view three-dimensional (“3D”) representations of data within a3D environment (e.g., a 3D space, a 3D spatial region, etc.) from afirst person perspective (e.g., on a two or three-dimensional displayscreen, or on any other suitable display screen, etc.). The system maybe configured to allow the user to interact with the data by freely anddynamically moving (e.g., translating, panning, orienting, tilting,rolling, etc.) a virtual camera—which may represent a particularlocation of the user as represented in the 3D environment with aparticular visual perspective—through the 3D environment. This mayprovide the user with a clearer understanding of the data. In particularembodiments, the data, which may correspond to one or more attributes ofvirtual or real-world objects, is updated dynamically in real time sothat the user may visually experience changes to the data at leastsubstantially in real time.

As a particular example, a particular three-dimensional representationof values stored within a particular data object may have one or morephysical or non-physical attributes (e.g., “facets,” “aspects,”“colors,” “textures,” “sizes,” visual effects, etc.) that each reflectthe value of a data field within the data object. For the purposes ofillustration, a data object may be a location in memory that has a valueand that is referenced by an identifier. A data object may be, forexample, a variable, a function, or a data structure. It is in no waylimited to objects of the kind used in object-oriented programming,although it may include those.

In particular embodiments, the three-dimensional representation ofvalues may be a three-dimensional object (e.g., a node, a shape, arectangle, a regular shape, an irregular shape, etc.). As a particularexample, the node may be a rectangular prism that corresponds to a dataobject that indicates the usage, by a particular computer application,of a particular computer's resources. In this example: (1) the size ofthe rectangular prism may correspond to the percentage of the system'smemory that the application is using at a particular point in time; and(2) the color of the rectangular prism may indicate whether theapplication is using a small, medium, or large amount of the system'smemory at that point in time. For example, the color of the sphere maybe displayed as: (1) green when the application is using 15% or less ofthe system's memory; (2) yellow when the application is using between15% and 50% of the system's memory; and (3) red when the application isusing 50% or more of the system's memory. In this case, the fact that aparticular rectangular prism is red is intended to alert a user to thefact that the application to which the rectangular prism corresponds isusing an unusually large amount of the system's memory.

In various embodiments, the system is adapted to display, in one or moredisplayed views of the three-dimensional environment, nodes thatcorrespond to related data objects in a cluster in which the variousrelated data objects are proximate to each other. The system may alsodisplay, in one or more displayed views of the three-dimensionalenvironment, a cluster designator adjacent the group of related nodesthat serves to help a user quickly identify a group as a related groupof nodes. For example, the system may display a group of nodes on avirtual “floor” within the three-dimensional environment and display asemi-transparent dome-shaped cluster designator adjacent and over thegroup of nodes so that the cluster designator encloses all of the nodesto indicate that the nodes are related. The system may also display texton or adjacent to the dome that indicates the name of the group ofnodes.

As noted above, the system may be adapted to modify the appearance of aparticular node, in one or more displayed views of the three-dimensionalenvironment, to an alert configuration/indicator/status to alert usersthat the value of one or more fields of the data object that correspondsto the node is unusual and/or requires immediate attention, such asbecause the value has exceeded a user-defined threshold. In particularembodiments, the system accomplishes this by changing the value of oneor more attributes that are mapped to the node. In particularembodiments, the system may be configured to modify the appearance of aparticular cluster designator to alert users that one or more nodeswithin the cluster designator are in an alert status. For example, thesystem may change the color of the cluster designator to red if any ofthe nodes within the cluster designator turn red to indicate an alert.This is helpful in drawing the user's attention first to the clusterdesignator that contains the node of immediate concern, and then to thenode itself.

In particular embodiments, once the value of the data within the dataobject of interest returns to normal, the system turns the color of therelated node to a non-alert color. Likewise, a cluster designator in oneor more displayed views of the three-dimensional environment may changecolor based on more than a user-defined number of the nodes within itbeing in an alert status. The system will also return the color of thecluster designator to a non-alert color when there are no longer morethan a user-defined number of nodes within the cluster designator in analert status.

In particular embodiments, a second-level cluster designator may be usedto contain one or more cluster designators in the three-dimensionalenvironment. Additionally, optionally, or alternatively, thesecond-level cluster designator may comprise one or more nodes. Thisconfiguration may serve to help a user quickly identify and referencegroups of cluster designators. For example, the system may display asemi-transparent sphere-shaped second-level cluster designator adjacentmultiple first-level cluster designators (such as the dome-shaped nodesdiscussed above) so that the second-level cluster designator encloseseach of the first-level cluster designators and any nodes within thefirst-level cluster designators. The system may also display text on oradjacent the sphere that indicates the name of the group of clusterdesignators. In particular embodiments, the system may be configured tomodify the appearance of a particular second-level cluster designator(e.g., in the manner discussed above in regard to first-level clusterdesignators, etc.) to alert users that one or more first-level clusterdesignators and/or nodes within the second-level cluster designator arein an alert status.

The system may also allow users to mark various nodes or clusterdesignators by changing, or adding to, the appearance of the nodes orcluster designators. For example, the system may be adapted to allow auser to attach a marker, such as a flag, to a particular node ofinterest. This may allow the user, or another user, to easily identifythe node during a later exploration of the three-dimensionalenvironment.

In particular embodiments, the system is adapted to allow multiple usersto explore the three-dimensional environment and relatedthree-dimensional nodes at the same time (e.g., by viewing the same datafrom different viewpoints on display screens of different computers,etc.). This may allow the users to review and explore the datacollaboratively, independently, repeatedly, etc.

The system may be adapted to allow a user to record the display of theuser's display screen, which presents displayed views of athree-dimensional environment—as the user “moves” through thethree-dimensional environment (e.g., virtual, virtual overlaid orsuperimposed with a real-world environment, etc.). This allows the userto later replay “video” of what the user experienced so the user'sexperience and related data can be shared with others. One or more userscan also reexamine the experience and related data; reproduce a problemin the replay; etc.

The system may be further adapted to allow users to “play back” data(e.g., in the form of streams of data objects or any other suitableform, etc.) from an earlier time period and explore the data in thethree-dimensional environment during the playback of the data. This mayallow the user (or other users) to explore or re-explore data from apast time period from new perspectives and/or new locations.

The system may also be configured to allow users to view one or morestreams of data in real time. In some embodiments, a stream of data asreceived by a system as described herein comprises at least a portion ofunstructured data, which has not been analyzed/parsed/indexed bypreceding devices/systems through which the stream of data reaches thesystem. In such embodiments, the attributes of the various nodes maychange over time as the underlying data changes. For example, the size,color, transparency, and/or any other physical attribute (attribute) ofa particular node may change as the values of the fields within theunderlying data objects change in real time. The user can explore thisrepresentation of the data as the user's viewpoint moves relative to theobjects. Additional examples of user exploration of data represented ina three-dimensional environment as described herein are described in arelated application, U.S. patent application Ser. No. 14/226,511entitled “DOCKABLE BILLBOARDS FOR LABELING OBJECTS IN A DISPLAY HAVING ATHREE-DIMENSIONAL PERSPECTIVE OF A VIRTUAL OR REAL ENVIRONMENT” (whichclaims priority of Provisional Application Ser. No. 61/860,882, filedJul. 31, 2013) by ROY ARSAN, ALEXANDER RAITZ, CLARK ALLAN, CARY GLENNOEL, filed on even date herewith, the entire contents of which arehereby incorporated by reference as if fully set forth herein.

As described in greater detail below, the system may be used tographically represent data from any of a variety of sources in displayedviews of the three-dimensional environment. Such sources may include,for example, data from a traditional database, from a non-database datasource, from one or more data structures, from direct data feeds, orfrom any suitable source.

Various modifications to the preferred embodiments and the genericprinciples and features described herein will be readily apparent tothose skilled in the art. Thus, the disclosure is not intended to belimited to the embodiments shown, but is to be accorded the widest scopeconsistent with the principles and features described herein.

2. Structure Overview

As discussed above, a computer system, according to various embodiments,is adapted to allow a user to view three-dimensional representations ofdata objects within a 3D environment from a first person perspective(e.g., on a two or three-dimensional display screen, on any othersuitable display screen, etc.). The system may be configured to allowthe user to interact with the data objects by freely and dynamicallymoving a virtual camera through the 3D environment. This may provide theuser with a clearer understanding of the data objects and therelationships between them. In particular embodiments, the data objectsare updated dynamically in real time so that the user may visuallyexperience changes to the data objects as the changes occur over time.

Below is a more detailed discussion of systems and methods according tovarious embodiments. The discussion includes an overview of both anexample system architecture and the operation of a Setup Module and aDisplay Module according to various embodiments.

FIG. 1 is a block diagram of a System 100 according to a particularembodiment. As may be understood from this figure, the System 100includes one or more computer networks 145, a Data Store 140, a DataDisplay Server 150, and one or more remote computing devices such as aMobile Computing Device 120 (e.g., a smart phone, a tablet computer, awearable computing device, a laptop computer, etc.). In particularembodiments, the one or more computer networks 145 facilitatecommunication between the Data Store 140, Data Display Server 150, andone or more remote computing devices 120, 130.

The one or more computer networks 145 may include any of a variety oftypes of wired or wireless computer networks such as the Internet, aprivate intranet, a mesh network, a public switch telephone network(PSTN), or any other type of network (e.g., a network that usesBluetooth or near field communications to facilitate communicationbetween computers, etc.). The communication link between the Data Store140 and Data Display Server 150 may be, for example, implemented via aLocal Area Network (LAN) or via the Internet.

As will be understood in light of the discussion below, the varioussteps described herein may be implemented by any suitable computingdevice, and the steps may be executed using a computer readable mediumstoring computer executable instructions for executing the stepsdescribed herein. For purposes of the discussion below, various stepswill be described as being executed by a Setup Module and a DisplayModule running on the Data Display Server 150 of FIG. 1. An examplestructure and functionality of the Data Display Server 150 are describedbelow in reference to FIG. 10.

Returning to FIG. 1, in various embodiments, the Data Display Server 150or other suitable server is adapted to receive and store information inthe Data Store 140 for later use by the Data Display Server. This datamay, for example, be received dynamically (e.g., as a continuous streamof data, etc.) or via discrete transfers of data via the one or morenetworks 145, or via any other suitable data transfer mechanism. TheData Display Server 150 may then use data from the data store 140 increating and displaying the three-dimensional representations of thedata discussed below.

3. Setup Module

In various embodiments, before the data display server 150 displaysinformation to a user, a suitable individual defines a correlationbetween various fields of a particular data object and one or moreattributes of a particular three-dimensional node that is to representthe data within those fields. FIG. 2 shows an example table that liststhe relationships between the respective fields and their correspondingattributes. In some embodiments, these relationships can be generated orupdated by a user with a single command at a command line interface,with a script, etc. This single command, script, etc., can be modifiedby the user dynamically to generate updates and changes to displayedviews of the three-dimensional environment while these displayed viewsbased at least in part on these relationships are being rendered. Inthis example, the data object has been set up to specifically include3D-related fields (width, height, color, etc.) for use in generating asuitable three-dimensional node to represent the data within the dataobject.

The table in FIG. 2 shows, for example, that the value of the field“width” will determine the width of a node that is in the form of arectangular box, that the value of the field “height” will determine theheight of the node, and that the value of the field “depth” willdetermine the depth of the node. In this example, the field name will beused to populate the text within a banner to be displayed adjacent thenode and any cluster designators that correspond to the node. In variousembodiments the values of these attributes may change as the underlyingdata within the fields of the node changes, which may cause theappearance of the node in one or more displayed views of thethree-dimensional environment to change dynamically on the user'sdisplay. The amount or ways in which an attribute of a 3D object changesas the underlying data that it represents changes may occur according toa mapping or scale that may be defined by the user.

In particular embodiments, the setup module may also allow the user toset up the user's desired interface for navigating a three-dimensionaldisplay of data within various data objects (e.g., via a sequence ofdisplayed views of the three-dimensional environment based on a sequenceof combinations of locations and perspectives of a virtual “camera,”etc.). For example, a user may indicate that the user wishes to usevarious keys on a keyboard to move a virtual “camera” in threedimensions relative to the three-dimensional environment. The systemmay, for example, allow a user to specify particular keys for moving thecamera forward, backward, to the left and to the right within a virtualthree-dimensional environment. The system may also allow the user tospecify particular keys for panning the camera from left to right, toadjust the height of the camera, and to control the movement of thecamera in any other suitable manner, using any other suitable peripheraldevice (e.g., a mouse, a joystick, a motion sensor, etc.).

Similar techniques, such as those described above, may be used to mapany particular type of data delivered in any suitable format. As aparticular example, in an example in which the system is to receive acontinuously updating real-time data feed from a particular sensor(e.g., a temperature sensor, other sensors, etc.), the setup module mayallow a user to specify how the user wishes the data to correspond toone or more attributes of a particular three-dimensional object (e.g.,as the height or width of a particular three-dimensional vertical prism,etc.) represented in the three-dimensional environment. This sametechnique may be used to map multiple different types of data todifferent attributes of a single three-dimensional object; for example,the height of a prism may correspond to a current value of a firstsensor reading (or other variable) and the depth of the same prism maycorrespond to a current value of a second sensor reading.

4. Display Module

In particular embodiments, once the system is properly set up, thesystem may execute a display module to create and displaythree-dimensional representations of data, such as data from thesystem's data store 140. A sample, high-level operation of the datadisplay module 300 is shown in FIG. 3. As shown in this Figure, whenexecuting this module, the system begins at Step 310A by receiving a setof data objects comprising at least a first data object and a seconddata object. Next, at Step 320A, the system generates a firstthree-dimensional node having at least one attribute that at leastapproximately reflects a value of at least one field within the firstdata object.

The system may generate the first-three-dimensional node by, forexample, using a suitable scale for the at least one attribute to conveythe value of the at least one field within the first data object. Forexample, where the value conveyed by the attribute is a first percentage(e.g., a percentage of CPU usage, etc.), the system may be configured togenerate the three-dimensional node with an attribute (e.g., such asheight, length, width, depth, etc.) where the attribute has a dimensionbased at least in part on a maximum dimension. When generating thethree-dimensional node, the system may generate the attribute where theattribute has a dimension that is the first percentage of the maximumdimension. In other embodiments, where the value is a particular value,the system may generate an attribute with a dimension based, at least inpart, on the particular value's relation to a maximum for that value(e.g., by converting the particular value to a percentage of themaximum, etc.).

As a particular example, a particular three-dimensional node may have aheight attribute that represents a CPU usage of a particular softwareprogram (e.g., a system process, a user process, a database process, anetworking process, etc.) represented by the particularthree-dimensional node. When generating the particular three-dimensionalnode, the system determines a suitable height for the particularthree-dimensional node based at least in part on the CPU usage and amaximum height for three-dimensional data objects. The maximum heightfor three-dimensional data objects may include any suitable maximumheight, such as, for example, a particular number of pixels, aparticular distance within the 3D environment, etc. The maximum heightmay be provided by a user of the system, or a suitable maximum heightmay be determined by the system. In this example, if the suitablemaximum height were 200 pixels and the CPU usage were 60%, the systemwould generate the particular three-dimensional node with a height of120 pixels. In displayed views of the three-dimensional environmentgenerated by a system as described herein, heights of nodes may change(e.g., plateauing, undulating, rising or descending rapidly,oscillating, etc.) as the underlying CPU usages of software programschange, which may cause the appearance of the nodes to changedynamically on the user's display. In some embodiments, this scaling ofattributes may enable a user of the system to relatively easily comparethe attributes (e.g., representing CPU usages, etc.) among two or morethree-dimensional nodes within the 3D environment, quickly identify(e.g., possible anomaly, etc.) software programs that are over-consumingCPU usages over a period of time, etc.

As another particular example of three-dimensional node generation, thesystem may generate a three-dimensional node with a color attribute thatcorresponds to CPU usage. When generating the three-dimensional node,the system may assign a color based at least in part on the CPU usageand a suitable color scale. For example, the color of thethree-dimensional data object mode may indicate whether the CPU usage islow, medium, or high at that point in time. For example, the color ofthe three-dimensional node may be displayed as: (1) green when the CPUusage is 15% or less; (2) yellow when the CPU usage is between 15% and50%; and (3) red when the CPU usage is 50% or more. In some embodiments,the system may utilize a color scale for the color attribute thatincludes a particular color at various levels of saturation. Forexample, the system may generate a three-dimensional node that is: (1)red with a high saturation for high CPU usages (e.g., CPU usages above70%, etc.); (2) red with a medium saturation for medium CPU usages(e.g., CPU usages between 30% and 70%, etc.); and (3) red with a lowsaturation for low CPU usages (e.g., CPU usages below 30%, etc.). Insuch embodiments, the use of varying saturation for the color attributein one or more displayed views of the three-dimensional environment thatincludes the three-dimensional node may enable a user of the system tosubstantially easily ascertain the CPU usage for the data represented bythe three-dimensional node based on the saturation of thethree-dimensional node's color.

Returning to Step 330A, the system proceeds by generating a secondthree-dimensional node having at least one attribute that at leastapproximately reflects a value of at least one field within the seconddata object. The system then advances to Step 340A, where it allows theuser to view the first and second nodes from a first person perspective(e.g., from finite distances that are dynamically changeable by theuser, etc.) in a three-dimensional environment by facilitating allowingthe user to dynamically move a virtual camera, in three dimensions,relative to the first and second three-dimensional nodes. A suitablethree-dimensional environment and various example three-dimensionalnodes are discussed in greater detail below.

5. Example Three-Dimensional Environments

Several example three-dimensional environments are shown in FIG. 4through FIG. 8. As may be understood, for example, from FIG. 4, asuitable three-dimensional environment may be displayed as athree-dimensional projection (e.g., a displayed view, etc.) in whichthree-dimensional points from the environment are mapped into atwo-dimensional plane. As may be understood from this figure, thethree-dimensional environment may include a three-dimensional referencesurface (in this case a checkered floor 405) and a light source (notshown) to enhance the three-dimensional effect of the display. In someembodiments, the three-dimensional environment, the three-dimensionalreference surface therein, may comprise one or more spatial (e.g.,geographical, topological, topographic, etc.) features or layouts otherthan, or in addition to, a flat or planar surface. In some embodiments,the three-dimensional environment may comprise one or more ofcomputer-generated images, photographic images, 2D maps, 3D map, 2D or3D representation of the physical surrounding of a user, a 2D or 3Drepresentation of business facilities, data centers, server farms,distribution/delivery centers, transit centers, stadiums, sportsfacilities, education institutions, museums, etc.

In some embodiments, a system as described herein can be configured tooverlay or superimpose 2D and 3D displayed views, nodes, clusterdesignators, graphic objects, etc., perceptually with a real-worldenvironment. In some embodiments, these displayed views, nodes, clusterdesignators, graphic objects, etc., can be rendered in a manner thatthey are overlaid or superimposed with entities these displayed views,nodes, cluster designators, graphic objects, etc., represent.

In an example, while a user is walking in a data center, a portablecomputing device, a wearable device, etc., with the user may render 2Dand 3D displayed views, nodes, cluster designators, graphic objects,etc., representing computers, hosts, servers, processes, virtualmachines running on hosts, etc., at specific coordinates (e.g., x-y-zcoordinates of a space representing the three-dimensional environment,etc.) of the user's real-world environment at the data center; thespecific coordinates of the 2D and 3D displayed views, nodes, clusterdesignators, graphic objects, etc., may correspond to locations of therepresented computers, hosts, servers, computers hosting processes orvirtual machines in the data center.

In another example, while a user is walking in Times Square, New York, awearable computing device may render 2D and 3D displayed views, nodes,cluster designators, graphic objects, etc., at specific coordinates(e.g., x-y-z coordinates of a space representing the user's realenvironment, etc.) of the user's real-world environment at Times Square,for example, as if the 2D and 3D displayed views, nodes, clusterdesignators, graphic objects, etc., are a part of the user's real-worldenvironment.

In some embodiments the three-dimensional environment is rendered usinga three-dimensional perspective on a two-dimensional display, and it maybe rendered and explored similar to the way a game player might navigatea first-person shooter videogame (e.g., using keyboard controls tonavigate the three-dimensional environment). In some embodiments, thethree-dimensional environment may be rendered in three dimensions using,for example, a virtual reality display (such as the Oculus Rift),holograms or holographic technology, a three-dimensional television, orany other suitable three-dimensional display.

In various embodiments, the system is configured to enable one or moreusers to move within the 3D environment by controlling the position ofthe virtual camera as described above. In various embodiments, theuser-controlled virtual camera provides the perspective from which thesystem is configured to display the 3D environment to the user. Asdiscussed above, the system may be configured to enable the user toadjust the position of the virtual camera in any suitable manner (e.g.,using any suitable input device such as a keyboard, mouse, joysticketc.).

Use of keyboard input to navigate a simulated 3D environment rendered ona 2D display is known in the context of first-person shooter video gamesbut has heretofore not been used for the purposes of navigating a 3Denvironment where 3D objects are used for visualizing a stream of data(or real-time data). Such an application is contemplated by theinventors and included in the present invention.

6. Nodes

Still referring to FIG. 4, the three-dimensional display may include aplurality of nodes 410, 415, and 420 that serve as a three-dimensionalrepresentation of the data within a particular data object. As discussedabove, one or more of the various attributes of the nodes may be chosento reflect a value of a particular data field within the data object.For example, if the node is a rectangular prism that corresponds to adata object that indicates the usage, by a particular computerapplication, of a particular computer's resources: (1) the size of theprism may correspond to the percentage of the system's memory that theapplication is using at a particular point in time; and (2) the color ofthe prism may indicate whether the application is using a small, medium,or large amount of the system's memory at that point in time. Forexample, the color of the prism may be displayed as: (1) green when theapplication is using 15% or less of the system's memory; (2) yellow whenthe application is using between 15% and 50% of the system's memory; and(3) red when the application is using is using 50% or more of thesystem's memory. In this case, the fact that a particular sphere is redis intended to alert a user to the fact that the application to whichthe sphere corresponds is using an unusually large amount of thesystem's memory.

It should be understood that any suitable attribute may be used torepresent data within a particular data object. An attribute of a 2D or3D object can be rendered by a system as described herein in one or moredisplayed views of a three-dimensional environment as a visually (and/oraudibly) perceivable property/feature/aspect of the object. Examples ofsuitable visualized three-dimensional attributes may include, forexample, the node's shape, width, height, depth, color, material,lighting, top textual banner, and/or associated visual animations (e.g.,blinking, beaconing, pulsating, other visual effects, etc.).

In some embodiments, time-varying visual effects, such as beaconing(e.g., an effect of light emitting outwards from a 2D or 3D object,etc.), pulsating, etc., can be used in visual animations of one or more2D or 3D objects (e.g., cluster designators, nodes, etc.). FIG. 6depicts examples of beaconing and pulsating that can be used indisplayed views of a three-dimensional environment as described herein.

In an example, a cluster designator of a particular level may comprise anumber of lower level clusters or nodes that may perform a type ofactivity such as messaging, interne traffic, networking activities,database activities, etc. Based on states, measurements, metrics, etc.,associated with or indicative with the intensities of the type ofactivities, the cluster designator may be depicted in thethree-dimensional environment as beaconing particular colors (e.g., red,yellow, mixed colors, etc.) outwardly from the cluster designator. Thefrequency of beaconing can be made dependent on the intensities of thetype of activities (e.g., beaconing quickens when the intensities arerelatively high and slows even to no variation when the intensities arerelatively low, etc.).

In another example, a cluster designator of a particular level maycomprise a number of lower level clusters or nodes; a particular lowerlevel cluster or node among them may be relatively significant among thelower level clusters, in relative critical state, etc. Based on states,measurements, metrics, etc., associated with the particular lower levelcluster or node, the cluster designator may be depicted in thethree-dimensional environment with the particular lower level cluster ornode visually pulsating (e.g., with time varying lights, sizes,textures, etc.) inside the cluster designator. The frequency ofpulsating can be made dependent on the states, measurements, metrics,etc., associated with the particular lower level cluster or node (e.g.,pulsating or glowing quickens when an alert state becomes relativelycritical and slows even to no pulsating or glowing when the alert statebecomes relatively normal, etc.).

In various embodiments, different time varying visual effects (e.g.,color changes, brightness changes, visual size changes, spatialdirection changes, visible motions, oscillations, etc.) can be used todepict measurements, metrics, states, etc., of components as representedin a three-dimensional environment as described herein. Thus, techniquesas described herein can be used to easily and efficiently visualize,explore, analyze, etc., various types, sizes or portions of data (e.g.,real time data, big data, stored data, recorded data, raw data,aggregated data, warehoused data, etc.).

Attributes may also include non-visual data, such as audio that isassociated with the node (e.g., that is played louder as the cameraapproaches the node and is played more softly as the camera moves awayfrom the node, etc.).

In various embodiments, a data display can be rendered by a system asdescribed herein to display the current value of one or more fieldswithin a data object on a node (or other node) associated with the dataobject. In particular embodiments, the system may be configured to allowa user to interact with the node (e.g., within a three-dimensionalenvironment, etc.) to change which of the particular field values thatare displayed on the node.

7. Cluster Designators

As shown in FIG. 5, in various embodiments, the system is adapted todisplay one or more cluster designators 505, 510 that each correspond toa respective set of related nodes 515, 520 that are positioned proximateeach other in a cluster. Examples of two nodes proximate to each othermay include, but are not limited to only: the two nodes locating withina finite contiguous region, a region of a finite radius, a building, acity, etc. as represented in displayed views of the three-dimensionalenvironment. Each cluster designator 505, 510 may help a user to quicklyidentify its corresponding group of related nodes 515, 520 as a discretegroup of nodes. For example, the system may display a particular groupof nodes 515 on a virtual “floor” 525 within the three-dimensionalenvironment and display a semi-transparent dome shaped clusterdesignator 505 adjacent and over the group of nodes 515 so that thecluster designator 505 encloses all of the nodes 515. The system mayalso display text 530 on or adjacent the dome that indicates the name ofthe group of nodes 515 (in this case “installtest-cloudera 1-SA”).

In particular embodiments, each node within a group of clusters includesan attribute that reflects the same type of data as other nodes withinthe clusters. For example, the respective height of each node within aparticular group (cluster) of nodes may correspond to an averageinterrupts/second value for a respective processor over a predeterminedtrailing period of time.

It should be understood that cluster designators may take a variety ofdifferent forms. For example, cluster designators may take the form ofany suitable three-dimensional object that is positioned adjacent agroup of related nodes to spatially or otherwise indicate a grouprelationship between the nodes, such as a rectangle, a sphere, apyramid, a cylinder, etc.

As noted above, the system may be adapted to modify the appearance of aparticular node to an alert configuration to alert users that a value ofone or more fields of the data object that corresponds to the node isoutside a predetermined range and/or requires immediate attention. Inparticular embodiments, the system accomplishes this by changing thevalue of one or more attributes that are mapped to the node to an alertconfiguration. In particular embodiments, the system may be configuredto modify the appearance of a particular cluster designator 505, 510 toalert users that one or more nodes 515, 520 within the clusterdesignator 505, 510 are in an alert status. For example, the system maychange the color of the cluster designator to red if any of the nodeswithin the cluster designator turns red to indicate an alert (or inresponse to any other attribute of the nodes within the clusterdesignator changing to an alert configuration). This is helpful indrawing the user's attention first to the cluster designator 505, 510that contains the node of immediate concern, and then to the nodeitself.

In particular embodiments, once the value of the data within the dataobject of interest returns to normal, the color of the related nodereturns to a non-alert color. The color of the cluster designator 505,510 will also return to a non-alert color assuming that no other nodes515, 520 within the cluster designator are in alert status.

As shown in FIG. 6, in particular embodiments, a second-level clusterdesignator 605 may be used to contain multiple cluster designators. Thismay serve to help a user quickly identify and reference groups ofcluster designators. For example, the system may display asemi-transparent sphere-shaped second-level cluster designator 605, 610,615 adjacent multiple first-level cluster designators (such as thedome-shaped nodes discussed above) so that the second-level clusterdesignator encloses each of the first-level cluster designators and anynodes within the first-level cluster designators. The system may alsodisplay text on or adjacent the sphere that indicates the name of thegroup of cluster designators. In particular embodiments, the system maybe configured to modify the appearance of a particular second-levelcluster designator (in the manner discussed above in regard tofirst-level cluster designators) to alert users that one or morefirst-level cluster designators and/or nodes within the second-levelcluster designator are in an alert status, or that other predeterminedcriteria are satisfied (e.g., more than a threshold number offirst-level clusters or nodes within the second-level cluster satisfycertain criteria, such as currently being in alert status, etc.).

8. Hierarchies of Components

A cluster designator of a particular level (e.g., first-level,second-level, etc.) as described herein may be used to capture one ormore of a variety of relationships in nodes, groups of nodes, lowerlevel cluster designators, etc. In some embodiments, nodes in athree-dimensional environment as described herein may be used torepresent a variety of components at various levels of a hierarchy ofcomponents that are related in a plurality of relationships. Forexample, a virtual machine may be a component of a first-level runningon a host of a second-level (e.g., a level higher than the level of thevirtual machine, etc.), which in turn may be included in a host clusterof a third level (e.g., a level higher than the levels of both the hostand the virtual machine, etc.). A virtual center may, but is not limitedto only, be at a fourth level (e.g., a level higher than the levels ofthe host cluster, the host and the virtual machine, etc.), may includeone or more of cloud-based components, premise-based components, etc. Acomponent in the virtual center may, but is not limited to only, be ahost cluster.

In some embodiments, an attribute of a node or a cluster designatorrepresenting a higher level component can depend on one or more of datafields, measurements, etc., of (e.g., lower level, etc.) componentsincluded in (or related to) the higher level component; one or moreattributes of (e.g., lower level, etc.) nodes or clusters representingcomponents included in (or related to) the higher level component;algorithm-generated values, metrics, etc., computed based on one or moredata fields of (e.g., lower level, etc.) components included in (orrelated to) the higher level component; etc.

Examples of attributes of a (e.g., high level, low level, etc.)component may include, but is not limited to only, a state indicator(e.g., a performance metric, a performance state, an operational state,an alarm state, an alert state, etc.), metric, etc. The state indicator,metric, etc., can be computed, determined, etc., based at least in parton data fields, algorithm-generated values, metrics, etc., of thecomponent. The state indicator, metric, etc., can also becomputed/determined based at least in part on data fields,algorithm-generated values, metrics, etc., of lower level componentsincluded in (or related to) the component, etc. Examples of data fields,algorithm-generated values, metrics, etc., may include, withoutlimitation, measurements, sensory data, mapped data, aggregated data,performance metrics, performance states, operational states, alarmstates, alert states, etc.

In some embodiments, states of a particular type (e.g., an alert statetype, etc.) of lower level components can be reflected in, or propagatedfrom the lower level components to, a state of the same type in a higherlevel component. In some embodiments, a state of a component can becomputed/determined (e.g., via a state determination algorithm, etc.) byzero, one or more data fields of the component and states of zero, oneor more components (e.g., included in the component, related to thecomponent, etc.) immediately below the component in the hierarchy ofcomponents. In some embodiments, initially, states of leaf nodes (eachof which does not comprise other components from the hierarchy) arefirst computed/determined/assigned. Then states of (e.g., non-leaf,etc.) components (each of which includes at least one other component inthe hierarchy of components) immediately above the leaf nodes can becomputed/determined. Such state computation/determination of states ofcomponents in the hierarchy of components can be performed repeatedly,iteratively, recursively, breadth-first, depth-first, in compliance withdependence relationship as represented in the hierarchy of components,etc.

Thus, when a high level displayed view of a three-dimensionalenvironment shows that a cluster designator or a node representing ahigh level component (e.g., a virtual center that comprises numeroushost clusters, hosts, virtual machines, processes, etc.) has anattribute (e.g., red color, etc.) indicating an alert state, even if thedisplayed view either does not or only partially represent a lower levelcomponent (e.g., a specific host cluster, a specific host, a specificvirtual machine, a specific process, etc.) from which the alert state ofthe high level component originates, a user viewing the high leveldisplayed view can readily and visually infer that the high levelcomponent has at least an alert either at the high level component orone or more lower level component beneath and included in (or relatedto) the high level component.

In some embodiments, the high level displayed view as mentioned above isa view of the three-dimensional environment as viewed by the user with aspecific perspective at a specific location as represented (e.g., usinga virtual camera with the same specific perspective at the same specificlocation, etc.) in the three-dimensional environment. The user asrepresented in the high level displayed view of the three-dimensionalenvironment may have a first finite distance to the high level clusterdesignator or node that has the indicated alert state.

In various embodiments, a system as described herein can be configuredto change, based on one or more of user input or algorithms, the user's(or the virtual camera's) location or perspective as represented in athree-dimensional environment; for example, the user's location orperspective in the three-dimensional environment can be changed by thesystem (e.g., in real time, in playback time, in a review session, etc.)through one or more of continuous motions, discontinuous motions,GUI-based pointing operations, GUI-based selection operations, via headtracking sensors, motion sensors, GPS-based sensors, etc. A displayedview of the three-dimensional environment at a specific time point isspecific to the user's location and perspective as represented in thethree-dimensional environment at the specific time. Since the user'slocation and perspective as described herein are dynamically changeableby the user and/or the system, a displayed view of the three-dimensionalenvironment as described herein may or may not be a pre-configured viewof data such as an isometric view of a data chart (e.g., a preconfiguredview of a user with a fixed location or perspective such as frominfinity, etc.). Furthermore, a system as described herein can beconfigured to allow a user to explore data objects throughrepresentative cluster designators and/or nodes with any location (e.g.,at any finite distance, etc.) or perspective (e.g., at any spatialdirection in a three-dimensional environment, etc.).

In other approaches that do not implement techniques as describedherein, GUI data displays such as scatterplots, charts, histograms,etc., are based on predefined and preconfigured mappings between dataand GUI objects by developers/vendors/providers of the GUI datadisplays. Other GUI elements such as background images, layouts, etc.,are also typically predefined and preconfigured bydevelopers/vendors/providers of the GUI data displays. Thus, an end useris limited to fixed locations and perspectives (e.g., isometric,predefined, preconfigured, from infinity, etc.) that have beenpredefined and preconfigured by developers/vendors/providers of the GUIdata displays.

In contrast, displayed views of a three-dimensional environment asdescribed herein can be generated according to locations andperspectives as determined by a user when the user is exploring thethree-dimensional environment with the displayed views. The user canchoose to move in any direction over any (e.g., finite) distance at anyrate (e.g., constant motion, non-constant motion, discontinuous jumpingfrom one location to another location, etc.) in the three-dimensionalenvironment.

In some embodiments, a system as described herein is configured toprovide a simple command input interface for a user to enter a searchcommand, which can be used by the system to drive (e.g., on the fly,etc.) rendering of displayed views of a three-dimensional environment.The command input interface may, but is not limited to, be GUI based,command line based, separate window, in a separate designated portion ofa GUI display that renders displayed views of a three-dimensionalenvironment, etc. The user's search command is dynamically changeable bythe user as the user is viewing search results generated in response tothe user's search command; comprise data fields, indexes, etc., in alate binding schema that can be used to interpret input data from one ormore data sources; and can be used by the system to map various datafields, algorithm generated values, etc., to attributes (e.g., facets,dimensions, colors, textures, etc.) of cluster designators or nodes indisplayed views of the three-dimensional environment; etc.

In the present example, the user or the system can change the locationof the user as represented in the three-dimensional environment andobtain one or more views (e.g., along a trajectory chosen by the user, atrajectory programmatically generated by the system, etc.) from the highlevel displayed view. The user as represented in the one or more viewsof the three-dimensional environment may have a second finite distanceto the high level cluster designator or node that has the indicatedalert state.

In some embodiments, to investigate what causes the cluster designatoror node representing the high level component in the high leveldisplayed view of the three-dimensional environment to have theattribute (e.g., red color, etc.) of the alert state, a system asdescribed herein can be configured to receive user input which requestsfor additional information regarding the alert state of the high levelcomponent, provide the additional information that indicates whether thealert state is caused by one or more data fields of the high levelcomponents or whether the alert state is propagated from lower levelcomponents included in the high level component, etc.

In some embodiments, the system can be configured to receive userinput—e.g., subsequent to the user receiving additional information thatindicates that the alert state is propagated from lower level componentsincluded in the high level component, etc.—which specifies that the userwishes to be placed closer to or inside the cluster designator or noderepresenting the high level component, such that lower level components(e.g., immediately below the level of the high level component but notcomponents in the lower level components, etc.) included in the highlevel component can be rendered with their own attributes in one or morecluster designators or nodes that correspond to the lower levelcomponents. In a particular embodiment, the user can simply select thehigh level cluster designator or node to cause the user to be placednear or inside the cluster designator or node representing the highlevel component.

In response, the system can be configured to, based on the user input,render the lower level components included in the high level component(e.g., in one or more detailed internal views of the cluster designatoror node, etc.) with their corresponding attributes in one or morecluster designators or nodes that correspond to the lower levelcomponents. In particular, the user may be placed at second finitedistances from a new location and/or a new perspective in thethree-dimensional environment to the lower level components. In someembodiments, the system is configured to position the lower levelcomponents at their respective x-y-z coordinates in thethree-dimensional environment.

An x-y-z coordinate of a cluster designator or node in thethree-dimensional environment as described herein is an attribute of thecluster designator or node, and can be determined or set in one or moreof a variety of ways. In an example, the x-y-z coordinate of the clusterdesignator or node representing a component can be set by the system tobe close to x-y-z coordinates of other cluster designators or nodesrepresenting other components, when the component is logically orphysically close to, or related with, the other components. In anotherexample, the three-dimensional environment may represent a portion of areal-world environment, a real-world space, a real-world spatial region,etc.; an x-y-z coordinate of cluster designator or node representing acomponent in the three-dimensional environment may be set in relation tothe physical location or coordinate of the component in the real-worldenvironment, the real-world space, the real-world spatial region, etc.

In the present example, based on one or more lower level displayed views(e.g., the detailed internal views as mentioned above, etc.), the usercan visually determine whether any of the lower level components have analert state indication (e.g., through a color attribute of a clusterdesignator or node representing one of the lower level components in theone or more lower level displayed views, etc.), provide further input tothe system for the purpose of determining the underlying cause of thealert state. Thus, successive displayed views of the three-dimensionalenvironment at various levels enable the user to filter out componentsthat do not have a particular state and efficiently reach componentsthat do have the particular state. In some embodiments, the system canbe configured to receive user input that requests additional displays oractions associated with one or more cluster designators or nodes. Forexample, the system can be configured to provide raw data, measurements,metrics, data fields, states, etc., of the one or more clusterdesignators or nodes in one or more GUI components, GUI frames, panels,windows, etc., that may or may not overlay with displayed views of thethree-dimensional environment. In some embodiments, the system isconfigured to provide raw data collected for a component after a limitednumber of user GUI actions (e.g., no more than three clicks, etc.).

Such investigation of an underlying cause for a particular state (e.g.,an alert state, an out-of-service state, a critical alarm state, etc.)can be performed repeatedly, iteratively, recursively, breadth-first,depth-first, in compliance with dependence relationship as representedin the hierarchy of components, etc. In some embodiments, the user cango (e.g., traverse, etc.) back to a previous view and take a differentinvestigative route or trajectory to explore the three-dimensionalenvironment for the purpose of determining the underlying cause for theparticular state.

In some embodiments, some or all data (e.g., data fields that are mappedto attributes of cluster designators or nodes, data fields that are usedby algorithms to generate values, etc.) are updated, sourced, collected,etc., dynamically in real time (e.g., from data collectors, from datastreaming units, from sensors, from data interfaces, from non-databasesources, from database sources, etc.) so that the user may visuallyexperience/perceive/inspect changes to the data at least substantiallyin real time through a number of displayed views of thethree-dimensional environment in which the user can explore withlocations and perspectives at the user's choosing. For example, data,such as operational states, amount of memory taken by softwareprograms/processes, CPU usages consumed by hosts or virtualmachines/monitored processes thereon, etc., collected in real time canbe used to update attributes, such as shapes, colors, heights, textures,etc., of cluster designators or nodes representing components to whichthe collected data pertains.

In some embodiments, a system as described herein can be configured todisplay one or more views of a three-dimensional environment generatedbased at least in part on real time collected data to a user, performone or more of a variety of actions (e.g., as specified by user input,as determined based on algorithms, etc.) relating to components that arerepresented in the three-dimensional environment, update (e.g., based onnewly collected real time data, etc.) the one or more views of thethree-dimensional environment to the user, generate new views of thethree-dimensional environment to the user, etc.

Examples of actions as described herein include, but are not limited toonly, any of: actions performed by an external system external to thesystem that is rendering views of the three-dimensional environment;actions performed by the same system that is rendering views of thethree-dimensional environment, etc. Actions performed by the externalsystem can be invoked through one or more integration points interfacingexternal systems/devices, based on one or more system implementedworkflows/use cases, etc. Actions performed by the same system mayinclude, but are not limited to only, any of: placing amarker/flags/notes on a cluster designator or node, viewing additionalinformation, data tables, data fields, underlying components orentities, etc., relating to one or more components, bringing upadditional displayed views, exploring further in the three-dimensionalenvironment, assigning or transferring troubleshooting tasks to one ormore other users, etc.

For example, when a user determines that there is a runaway or hangprocess, an overactive VM, an entity consuming too much resources, etc.,that causes an alert state based on one or more displayed views of athree-dimensional environment, the user may select (e.g., pointing,clicking, hovering, tapping, etc.) one or more remedial/follow upactions related to the cause of the alert state. Examples ofremedial/follow up actions may include, but are not limited to only, anyof: killing a process; restarting/rebooting a host;installing/scheduling a software/system/application upgrade; performinga load balancing in a cluster of hosts/VMs/processors/processes; causinga failover from one active host/VM/processor/process to a backuphost/VM/processor/process; manipulating one or more controls of areal-world device, host, VM, processor, process, etc., that isrepresented in the three-dimensional environment or that has an impacton a component represented in the three-dimensional environment; settingup an alert state/flag/marker of one or more components, nodes, clusterdesignators, etc., forinvestigation/exploration/collaboration/auditing/action; etc.

In response to receiving the user's selection of the one or moreremedial actions, a system as described herein (e.g., a system that isrendering views of the three-dimensional environment, etc.) can beconfigured to carry out the one or more remedial actions. In an example,the system communicates with, and request, one or more external systemsto carry out at least one of the one or more remedial actions. In anexample, the system itself carries out at least one of the one or moreremedial actions.

9. Multiple Users

In particular embodiments, the system is adapted to allow multiple usersto explore the three-dimensional environment and relatedthree-dimensional nodes at the same time (e.g., by viewing the same datafrom different viewpoints on display screens of different computers,etc.). This may allow the users to review and explore the datacollaboratively. Also, as shown in FIG. 7, in certain embodiments, thesystem may be adapted to facilitate communication between the users(e.g., via a chat screen 705, etc.) and/or to display the relativepositions of the users within the three-dimensional environment on a map710 of the three-dimensional environment.

In some embodiments, the same three-dimensional environment as describedherein can be explored by multiple users represented at the same or evendifferent locations in the three-dimensional environment. For example,the three-dimensional environment may be an environment that representsa first user in Chicago and a second user in San Francisco. The firstuser and the second user can have their respective perspectives at theirrespective locations. The first user and the second user can have theirown displayed views of the same three-dimensional environment on theirown computing devices. At their choosing, the first user and the seconduser can explore a portion of the three-dimensional environment in acollaborative or non-collaborative manner; exchange their locations orperspectives; exchange messages/information/history with each other;etc.

10. Marking of Nodes

The system may also allow users to mark various nodes or clusterdesignators by changing, or adding to, the appearance of the nodes. Forexample, as shown in FIG. 8, the system may be adapted to allow a userto attach a marker, such as a flag 805, to a particular node of interest810 as the user moves a camera representing the user's viewpointrelative to the particular node of interest 810. This may allow theuser, or another user, to easily identify the node 810 during a laterexploration of the three-dimensional environment.

11. Record and Playback

The system may be adapted to allow a user to record the displayed viewsrendered on the user's display screen as the user “moves” through avirtual three-dimensional environment, or as the user moves through areal-world three-dimensional environment superimposed with the virtualthree-dimensional environment that comprises visible objects asdescribed herein. This allows the user to later replay “video” of whatthe user experienced so the user can share the user's experience and therelated data with others, and reexamine the experience.

The system may be further adapted to allow users to play back data(e.g., in the form of streams of data objects or any other suitableform, etc.) from an earlier time period and explore the data in thethree-dimensional environment during the playback of the data. This mayallow the user (or other users) to explore or re-explore data from apast time period from a new perspective.

A history of a user's location and/or the user's perspective asgenerated by the user's exploration (e.g., via the control of a virtualcamera representing the user's location and perspective, etc.) in athree-dimensional environment as described herein may constitute atrajectory comprising one or more time points and one or more ofuser-specified waypoints, system-generated waypoints, user-specifiedcontinuous spatial segments, system-generated continuous spatialsegments, as traversed by the user in the three-dimensional environmentat the respective time points. The trajectory of the user in thethree-dimensional environment can be recorded, replayed (or playedback), paused, rewound, fast-forwarded, altered, etc.

A history of underlying data that supports a user's exploration (e.g.,via the control of a virtual camera representing the user's location andperspective, etc.) in a three-dimensional environment as describedherein may be recorded by a system as described herein. Instead ofplaying back the user's own history of exploration, the underlying datathat supports the user's particular exploration can be explored orre-explored with same or different locations and/or perspectives ascompared with those of the user's own history of exploration.

12. Dynamic Nature of Data

The system may also be configured to allow users to view one or morestreams of data in real time. In such embodiments, the attributes of thevarious nodes may change over time as the underlying data within thedata objects SPLK0009USC3C1_Applicationchanges. The user may view thesedynamic changes as the user's viewpoint changes relative to the nodeswithin the three-dimensional environment. For example, the size, color,transparency, and/or any other attribute (or combination of attributes)of a particular node may change as the values of the fields within theunderlying data objects change in real time.

In various embodiments, the data within various data objects may includestatistical information that may represent information about datacollected over a discrete period of time. For example, a particularfield within a data object may correspond to the average number offailed attempts to log in to a particular web site over the precedinghour. In particular embodiments, the system may allow a user to observedynamic changes in this average number in real time by observing dynamicchanges in the size or shape (or other attribute) of a three-dimensionalnode that corresponds to the data object. For example, the height of thenode may fluctuate in real time as the average number changes.

13. Data Tracing

The system, in various embodiments, may be configured to display pastdata in addition to substantially current data in a particular node.FIG. 9 depicts an example displayed view 900 of a three-dimensionalenvironment displaying both current (e.g., 902, 906, etc.) and past(e.g., 904, 908, etc.) data for a particular attribute of the node(e.g., denoted as “indexin,” “aggregator,” etc.). Such a node maycomprise a first visual appearance (e.g., a first line style, a firstcolor, a first visual effect, etc.) at least approximately reflect avalue of at least one field within a particular data object. For thepurpose of illustration only, as shown in FIG. 9, the first visualappearance is a first height (corresponding to 902 or 906 of FIG. 9) asindicated by solid lines. The node may comprise a second visualappearance (e.g., a second line style, a second color, a second visualeffect, etc.) at least approximately reflect a value of the at least onefield within the data object at a previous time. For the purpose ofillustration only, as shown in FIG. 9, the second visual appearance is asecond height (corresponding to 904 or 908 of FIG. 9) as indicated bydash lines.

In a particular example, the at least one field within the data objectmay continuously update its value at a particular time interval (e.g.,every minute, every two minutes, or any other suitable time interval).The system may update the particular attribute representing that valueand generate a dashed line of a second height representing the prioramount of the value before the value was updated. In variousembodiments, the system may be configured to display this dashed linerepresenting the previous value for a particular amount of time (e.g.,15 seconds, 30 seconds, etc.) or until the value is updated again at thenext time interval. In some embodiments, displaying this dashed line mayenable users to view trends in the data (e.g., whether the value isincreasing or decreasing, etc.) and to determine what an immediatechange in the value was, and this may also indicate momentary peaks indata that might otherwise be missed (e.g., be imperceptible to a humanviewer) if only the current real-time value were on display. In someembodiments, the previous value as indicated by the second visualappearance (e.g., 904 of FIG. 9, etc.) is higher than the current valueas indicated by the first visual appearance (e.g., 902 of FIG. 9, etc.).In some embodiments, the previous value as indicated by the secondvisual appearance (e.g., 908 of FIG. 9, etc.) is lower than the currentvalue as indicated by the first visual appearance (e.g., 906 of FIG. 9,etc.). Thus, a user can immediately tell if the value of a data fieldhas not changed from a previous time, has slowly changed from a previoustime, has reached a maximum at a particular time (e.g., by observing aninflection of the dash lines representing the previous value tracingfrom below the current value to above the current value, etc.), hasreached a minimum at a particular time (e.g., by observing an inflectionof the dash lines representing the previous value tracing from above thecurrent value to below the current value, etc.), etc.

In various embodiments, the system may be configured to continuouslytrace one or more attributes of a particular graphical object (e.g., aplurality of attributes, etc.) in the manner described above. Forexample, the system may trace both a height and a width of a particulargraphical object, where height and width correspond to values fromdifferent fields within the data object. In other embodiments, thesystem may be configured to trace any suitable combination of attributes(e.g., length, depth, etc.).

Techniques as described herein can be used in both two-dimensional andthree-dimensional object depictions. For example, a first height in atwo-dimensional object (e.g., rectangle, etc.) in solid lines canrepresent a current value of a data field over a sequence of timepoints, whereas a second height in the two-dimensional object (e.g.,rectangle, etc.) in dash lines can represent a previous value of thedata field over the same sequence of time points.

The tracer can be depicted in any sort of visual ways that sets itapart. Dashed lines are not the only possibilities. Instead, a differentcolor could be used, or a transparency, or a dotted line, and so on.

The tracer may reflect the previous location of the attribute (which, inturn, represents the highest value reached) during a predetermined timeperiod immediately preceding the present moment. In some embodiments,the tracer only represents maximums above the present value; in otherembodiments, the tracer only represents minimums below the presentvalue; in yet other embodiments, the tracer represents both maximum andminimum values reached during the immediately preceding time period.This indicator may be referred to as a tracer because it essentiallyfollows the present value, but lags it by a period of time (which mayvary depending on when in the immediately preceding time period themax/min was reached).

14. Example Data Sources

It should be understood that the above techniques may be used to displayany suitable type of data to one or more users. Such data may include,for example, data obtained from a database (e.g., in the form of recordsthat each include one or more populated fields of data, etc.), or data(e.g., machine data, etc.) obtained directly (e.g., in real time, etc.)from one or more computing devices or any other suitable source.

It should also be understood that the system may obtain the data in anysuitable form and may or may not be processed by the system before thesystem maps the data to one or more attributes of a three-dimensionalobject and then displays the three-dimensional object to reflect thedata. The system may, for example, receive the data in the form of alive, real-time stream of data from a particular computer, processor,machine, sensor, or other real-world object. The data may be structuredor unstructured data. In particular embodiments, the data may bereceived from a software application.

In a particular embodiment, the system is adapted to: (1) obtain, from asuitable source, unstructured or semi-structured data that comprises aseries of “events” that each include a respective time associated withthe event (e.g., computer log entries, other time-specific events,etc.); (2) save the data to a data store; (3) create a semi-indexedversion of the data in which the events are indexed by time stamp; (4)allow a user to define (e.g., at any time, etc.) a schema (e.g., alate-binding schema where values are extracted at a time after dataingestion time such as search time, etc.) for use in searching thedata—the schema may include, for example, the name of one or moreparticular “fields” (e.g., fields that are previously undefined in theunstructured or semi-structured data, etc.) of data within the eventsand information regarding where the fields are located within the events(e.g., a particular field of information may be represented as the firstten characters after the second semi-colon in the event, etc.); (5)after the user defines the schema, allowing the user to specify a searchof the indexed events; (6) conducting the specified search of theindexed events; and (7) returning the results of the search to the user.In some embodiments, the system is configured to allow one or more usersto define or update a schema for unstructured or semi-structured datafrom a source (e.g., a non-database source, a database source, a datacollector, a data integration point, etc.) before, after, or at the sametime while, the system stores the unstructured or semi-structured data,derived data from the unstructured or semi-structured data. In someembodiments, at least some definitions (e.g., late-binding definitions,etc.) of a schema as described herein can be applied before, orcontemporaneously while, the system is generating search results as aresponse to receiving a search command/request (e.g., from a user, fromanother system, from another module of the system, etc.); the generationof the search results may make use of at least some of the definitions(e.g., as being updated, as predefined, etc.) of the schema as changedor updated to interpret, extract, aggregate, etc., the unstructured orsemi-structured data from the data source. Examples of definitions in aschema include, but are not limited to only, any of: (e.g., global tousers, global to data sources, user-specific, system-specific,data-source specific, etc.) definitions of data fields (e.g., previouslyundefined data fields by either the source or the system, etc.) inunstructured or semi-structured data, correspondence relationshipsbetween data fields in unstructured or semi-structured data and otherdata fields in the unstructured or semi-structured data, correspondencerelationships between data fields in unstructured or semi-structureddata and external entities (e.g., one or more attributes of GUI objectsin a 2D or 3D environment, one or more actions that can be performed onentities represented in a 2D or 3D environment, etc.), etc.

The technique above may be advantageous because it allows users to: (1)store raw data for use in later searches without having to delete orsummarize the raw data for later use, and (2) later decide how best todefine a schema for use in searching the data. This may provide aflexible system for searching data from a variety of disparate datasources.

In one embodiment, the system is adapted to receive a stream of dataobjects at least substantially in real time (e.g., in real time, etc.)and to use the techniques described herein to display data in the fieldsof the data objects. Such data may include events that have been indexedaccording to a late-binding schema, as described above, or othersuitable data.

15. Example System Operation

An example system for displaying information within a three-dimensionalenvironment may be used in the context of displaying informationassociated with processors within servers in a data center. In thisexample, the system may generate a three-dimensional environment thatincludes various three-dimensional nodes that represent variousprocessors within a particular server. The nodes may be grouped within aparticular cluster designator, which may for example, represent theparticular server. The particular cluster designator may be furthergrouped with other cluster designators within a cluster of clusterdesignators (a second-level cluster designator), where the cluster ofcluster designators represents a particular data center that includes aplurality of servers.

In this example, a user may be monitoring the various servers within thedata center and, in particular, monitoring the various servers'respective processors. The system may enable the user to view thevarious nodes within a particular cluster designator in order toascertain information about the various processors. For example, thenodes may include attributes that reflect data values that are updatedevery minute (or any other suitable period of time) and represent asample of data taken over an interval of time spanning the sixty minutes(or other suitable period of time) leading up to the minute at which thedata values are updated. For example, the system may update a value ofthe data at LOAM to reflect a sample of the data from 9 AM-10 AM, mayupdate the data at 10:01 AM to reflect a sample of the data from 9:01 AMto 10:01 AM and so on.

The data represented by the attributes and updated at the intervalsdiscussed immediately above, may include, for example, a percentage ofDeferred Procedure Calls (DPCs) time (e.g., a percentage of processortime spent processing DPCs during the sample interval, etc.); apercentage interrupt time (e.g., a percentage of processor time spentprocessing hardware interrupts during the sample interval, etc.); apercentage of privileged time (e.g., a percentage of elapsed time that aprocessor has been busy executing non-idle threads, etc.); or any othersuitable attribute or data that may be associated with a processor orthat may be of interest to a user in relation to the processor.

Each of these data may be represented by any suitable attribute of thethree-dimensional node for the particular processor. These attributesmay include, for example, height, color, volume, or any other suitableattribute discussed above. In this example, the system may enable to theuser to navigate through the 3D environment to view the variousthree-dimensional nodes within the various server cluster designators inorder to monitor the servers and the processors within the data center.

16. Example Data Collection System

FIG. 10 shows a block diagram illustrating a system for collecting andsearching unstructured time stamped events. The system comprises aserver 1015 that communicates with a plurality of data sources 1005 anda plurality of client devices 1040 over a network 1010, e.g., theInternet, etc. In various embodiments, the network 1010, may include alocal area network (LAN), a wide area network (WAN), a wireless network,and the like. In other embodiments, functions described with respect toa client application or a server application in a distributed networkenvironment may take place within a single client device without server1015 or network 1010.

In various embodiments, server 1015 may comprise an intake engine 1020(e.g., a forwarder that collects data from data sources and forward toother modules, etc.), an indexing engine 1025, and a search engine 1030.Intake engine 1020 receives data, for example, from data sources 1005such as a data provider, client, user, etc. The data can includeautomatically collected data, data uploaded by users, or data providedby the data provider directly. In various embodiments, the data receivedfrom data sources 1005 may be unstructured data, which may come fromcomputers, routers, databases, operating systems, applications, map dataor any other source of data. Each data source 1005 may be producing oneor more different types of machine data, e.g. server logs, activitylogs, configuration files, messages, database records, and the like.Machine data can arrive synchronously or asynchronously from a pluralityof sources. There may be many machine data sources and large quantitiesof machine data across different technology and application domains. Forexample, a computer may be logging operating system events, a router maybe auditing network traffic events, a database may be catalogingdatabase reads and writes or schema changes, and an application may besending the results of one application call to another across a messagequeue.

In some embodiments, one or more data sources 1005 may provide data witha structure that allows for individual events and field values withinthe events to be easily identified. The structure can be predefinedand/or identified within the data. For example, various strings orcharacters can separate and/or identify fields. As another example,field values can be arranged within a multi-dimensional structure, suchas a table. In some instances, data partly or completely lacks anexplicit structure. For example, in some instances, no structure for thedata is present when the data is received and instead is generatedlater. The data may include a continuous data stream having multipleevents, each with multiple field values.

In various embodiments, indexing engine 1025 may receive unstructuredmachine data from the intake engine 1020 and process the machine datainto individual time stamped events that allow for fast keywordsearching. The time information for use in creating the time stamp maybe extracted from the data in the event. In addition to a time stamp,the indexing engine 1025 may also include various default fields (e.g.,host and source information, etc.) when indexing the events. Theindividual time stamped events are considered semi-structured timeseries data, which may be stored in an unaltered state in the data store1035.

In the embodiment shown in FIG. 10, the data store 1035 is shown asbeing co-located with server 1015. However, in various embodiments, thedata store 1035 may not be physically located with server 1015. Forexample, data store 1035 may be located at one of the client devices1040, in an external storage device coupled to server 1015, or accessedthrough network 1010. The system may store events based on variousattributes (e.g., the time stamp for the event, the source of the event,the host for the event, etc.). For example, a field value identifying amessage sender may be stored in one of ten data stores, the data storebeing chosen based on the event time stamp. In some instances, ratherthan grouping various data components at specific storage areas, datastore 1035 may include an index that tracks identifiers of events and/orfields and identifiers of field values. Thus, for example, the index caninclude an element for “Data type=“webpage request” (indicating that theelement refers to a field value of “webpage request” for the field “datatype”) and then list identifiers for events with the field value (e.g.,“Events 3, 7, 9 and 16”, etc.).

Selective storage grouping can be referred to as storing data in“buckets”. Bucket definitions can be fixed or defined based on inputfrom a data provider, client or user. In embodiments that use atime-series data store, such that events and/or field values are storedat locations based on a timestamp extracted from the events, events withrecent timestamps (e.g., which may have a higher likelihood of beingaccessed, etc.) may be stored at preferable memory locations that lendto quicker subsequent retrieval. Storing events in buckets allows forparallel search processing, which may reduce search time.

In various embodiments, search engine 1030 may provide search andreporting capabilities. Search engine 1030 may include a schema engine1032 and a field extractor 1034. In various embodiments, search engine1030 receives a search query from client device 1040 and uses latebinding schema to conduct a search, which imposes field extraction onthe data at query time rather than at storage or intake time.

Schema engine 4010 can itself estimate a schema or can determine aschema based on input from a client or data provider. The input caninclude the entire schema or restrictions or identifications that may beused to estimate or determine a full schema. Such input can be receivedto identify a schema for use with the unstructured data and can be usedto reliably extract field values during a search. The schema can beestimated based on patterns in the data (e.g., patterns of characters orbreaks in the data, etc.) or headers or tags identifying various fieldsin the data, such as <event><message time>2014.01.05.06.59.59</> . . .</>). Schema can be received or estimated at any of a variety ofdifferent times, including (in some instances) any time between indexingof the data and a query time. Schema engine 410 can perform the schemaestimation once or multiple times (e.g., continuously or at routineintervals, etc.). Once a schema is determined, it can be modified, forexample periodically, at regular times or intervals, upon receivingmodification-requesting input, upon detecting a new or changed patternin the input, or upon detecting suspicious extracted field values (e.g.,being of an inconsistent data type, such as strings instead ofpreviously extracted integers, etc.), etc. In some instances, a clientor data provider can provide input indicating a satisfaction with orcorrection to estimated schema. Received or estimated schemas are storedin the data store 1035.

Search engine 1030 can perform real-time searches on data once indexedor it may perform search after the data is stored. If the search queryis a real-time late binding schema based search, the query is used toretrieve time stamped events from indexing engine 1025. In someembodiments, real-time searches can be forward-looking searches forfuture events that have not yet occurred. For example, a user may wantto monitor the activity of an organization's Information Technology (IT)infrastructure by having a continuously updated display of the top IPaddresses that produce ERROR messages. Alternatively, if the search is anon-real-time search, the query may be used to obtain past events thatare already stored in data store 1035. Non-real-time searches, orhistorical searches, are backwards-looking searches for events that havealready occurred. For example, a user might want to locate the top IPaddresses that produced ERROR messages within the last three hours.Additionally, if the search is a hybrid search query, events can beretrieved from both indexing engine 1025 and data store 1035. Hybridsearch queries are both forwards and backwards looking. An example is asearch query for the top IP addresses that produced ERROR messages in atime window that started four hours ago and continues indefinitely intothe future. At any time during either search process, search engine 1030may collect the search results to generate a report of the searchresults. The report is output to client device 1040 for presentation toa user.

Once the user defines the search string and schema for the search, thesearch engine 1030 can subsequently access and search all or part of thedata store. For example, search engine 1030 can retrieve all eventshaving a timestamp within a defined time period, or all events having afirst field value (e.g., HTTP method, etc.) set to a specified value(e.g., GET, etc.). The search may include a request to return values forone or more first fields for all events having specified values (e.g.,specific values or values within a specific range, etc.) for one or moresecond fields (e.g., the late binding schema applied at search time,etc.). To illustrate, search engine 1030 can retrieve all URLs in eventshaving a timestamp within a defined time period, or all events having afirst field value (e.g., HTTP method, etc.) set to a specified value(e.g., GET, etc.). In various embodiments, upon retrieving the eventdata of interest, search engine 1030 may further apply a late bindingschema to extract particular field from the search results. Theprocessing may be performed based on an individual value (e.g., toobtain a length or determine if an extracted field value matches aspecified value, etc.). In some instances, processing can be performedacross values, for example, to determine an average, frequency, count orother statistic, etc. Search engine 1030 can return the search result toa data provider, client or user (e.g., via an interface on client device1040, etc.).

Client devices 1040 may be personal computers, digital assistants,personal digital assistants, cellular phones, mobile phones, mobiledevices (e.g., tablets, etc.), laptop computers, Internet appliances,and other processor-based devices. In various embodiments, clientdevices 140 may be any type of processor-based platform that operates onany suitable operating system that is capable of executing one or moreuser application programs. For example, client device 140 can include apersonal computer executing a web browser that sends search queries toserver 115 and receives a search report from server 1015.

One or more of the devices illustrated in FIG. 10 may be connected to anetwork as previously mentioned. In some embodiments, all devices inFIG. 10 are connected to the network and communicate with each otherover the network. It should be noted that network 110 in FIG. 10 neednot be a single network (such as only the Internet) and may be multiplenetworks (whether connected to each other or not). In anotherembodiment, the network may be a local area network (“LAN”) and a widearea network (“WAN”) (e.g., the Internet, etc.) such that one or moredevices (for example, server 1015 and data store 1035) are connectedtogether via the LAN, and the LAN is connected to the WAN which in turnis connected to other devices (for example, client devices 1040 and datasources 1005). The terms “linked together” or “connected together”refers to devices having a common network connection via a network(either directly on a network or indirectly through multiple networks),such as one or more devices on the same LAN, WAN or some networkcombination thereof.

It should be understood that FIG. 10 is an example embodiment of thepresent system and various other configurations are within the scope ofthe present system. Additionally, it should be understood thatadditional devices may be included in the system shown in FIG. 10, or inother embodiments, certain devices may perform the operation of otherdevices shown in the figure. For purposes of this disclosure, referenceto a server, a computer, or processor, shall be interpreted to include:a single server, a single processor or a single computer; multipleservers; multiple processors, or multiple computers; or any combinationof servers and processors. Thus, while only a single server isillustrated, the term “computer”, “server”, and “processor” may alsoinclude any collection of computers, servers or processors thatindividually or jointly execute a set (or multiple sets) of instructionsto perform any one or more of the methodologies discussed herein.

Various features of the system, such as those described above, may bemodified to include features, feature connections and/or flows asdescribed in Carasso, David. Exploring Splunk Search Processing Language(SPL) Primer and Cookbook. New York: CITO Research, 2012 and/or asdescribed in Ledion Bitincka, Archana Ganapathi, Stephen Sorkin, andSteve Zhang. Optimizing data analysis with a semi-structured time seriesdatabase. In SLAML, 2010. Each of these references is herebyincorporated by reference in its entirety.

17. Additional Technical Details

As will be appreciated by one skilled in the relevant field, the presentinvention may be, for example, embodied as a computer system, a method,or a computer program product. Accordingly, various embodiments may takethe form of an entirely hardware embodiment, an entirely softwareembodiment, or an embodiment combining software and hardware aspects.Furthermore, particular embodiments may take the form of a computerprogram product stored on a computer-readable storage medium havingcomputer-readable instructions (e.g., software, etc.) embodied in thestorage medium. Various embodiments may take the form of web-implementedcomputer software. Any suitable computer-readable storage medium may beutilized including, for example, hard disks, compact disks, DVDs,optical storage devices, and/or magnetic storage devices.

Various embodiments are described herein with reference to blockdiagrams and flowchart illustrations of methods, apparatuses (e.g.,systems, etc.) and computer program products. It should be understoodthat each block of the block diagrams and flowchart illustrations, andcombinations of blocks in the block diagrams and flowchartillustrations, respectively, can be implemented by a computer executingcomputer program instructions. These computer program instructions maybe loaded onto a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions which execute on the computer or otherprogrammable data processing apparatus to create means for implementingthe functions specified in the flowchart block or blocks.

These computer program instructions may also be stored in acomputer-readable memory that can direct a computer or otherprogrammable data processing apparatus to function in a particularmanner such that the instructions stored in the computer-readable memoryproduce an article of manufacture that is configured for implementingthe function specified in the flowchart block or blocks. The computerprogram instructions may also be loaded onto a computer or otherprogrammable data processing apparatus to cause a series of operationalsteps to be performed on the computer or other programmable apparatus toproduce a computer implemented process such that the instructions thatexecute on the computer or other programmable apparatus provide stepsfor implementing the functions specified in the flowchart block orblocks.

Accordingly, blocks of the block diagrams and flowchart illustrationssupport combinations of mechanisms for performing the specifiedfunctions, combinations of steps for performing the specified functions,and program instructions for performing the specified functions. Itshould also be understood that each block of the block diagrams andflowchart illustrations, and combinations of blocks in the blockdiagrams and flowchart illustrations, can be implemented by specialpurpose hardware-based computer systems that perform the specifiedfunctions or steps, or combinations of special purpose hardware andother hardware executing appropriate computer instructions.

18. Example Process Flow

FIG. 12 illustrates an example process flow. In some embodiments, thisprocess flow is performed by a data display server (e.g., as shown inFIG. 1, etc.) comprising one or more computing devices or units. Inblock 1202, the data display server receives a set of time-dependentdata values of a data field. The set of time-dependent data valuescomprises values, of the data field, taken over time.

In block 1204, the data display server maps the set of time-dependentdata values of the data field to a time-dependent attribute of athree-dimensional object of a three-dimensional environment thatcomprises a representation of a user.

In block 1206, the data display server causes a first view of thethree-dimensional environment to be displayed to the user at a firsttime. The three-dimensional object as represented in thethree-dimensional environment and the user as represented in thethree-dimensional environment at the first time have a first finitedistance between each other in the three-dimensional environment. Thefirst view of the three-dimensional environment is a view of thethree-dimensional environment relative to a first location and a firstperspective of the user as represented in the three-dimensionalenvironment at the first time.

In block 1208, the data display server receives user input thatspecifies that the user as represented in the three-dimensionalenvironment has relocated in the three-dimensional environment to have asecond location and a second perspective; a combination of the secondlocation and the second perspective is different from a combination ofthe first location and the first perspective.

In block 1206, the data display server, in response to receiving theuser input, causes a second different view of the three-dimensionalenvironment to be displayed to a user at a second time that is laterthan the first time. The three-dimensional object as represented in thethree-dimensional environment and the user as represented in thethree-dimensional environment at the second time have a second finitedistance between each other in the three-dimensional environment. Thesecond view of the three-dimensional environment is a view of thethree-dimensional environment relative to the second location and thefirst perspective of the user as represented in the three-dimensionalenvironment at the second time.

In an embodiment, the set of time-dependent data values comprises afirst value of the data field at the first time and a second differentvalue of the data field at the second time; the attribute of thethree-dimensional object has a first visual appearance, in the firstview at the first time, that is visibly different from a second visualappearance which the attribute of the three-dimensional object has inthe second view at the second time.

In an embodiment, the set of time-dependent data values comprises one ormore of measurements streamed from a real-world component, measurementscollected in real time by a data collection device, measurements storedin one or more measurement data repositories, streams of machine datacollected from one or more of sensors or computing devices, web logscollected from one or more of web servers or web clients, streams ofunstructured data comprising unparsed data fields, or time series datastores.

In an embodiment, the three-dimensional object represents one of cubicshapes, three-dimensional rectangular shapes, three-dimensionalpolygonal shapes, three-dimensional conic shapes, three-dimensionalregular shapes, three-dimensional irregular shapes, etc.

In an embodiment, the attribute of the three-dimensional objectsrepresents a specific visual property of a three-dimensional shape.

In an embodiment, the attribute of the three-dimensional objectsrepresents one of facets, aspects, shapes, colors, textures, sizes,heights, widths, depths, materials, lighting, beaconing, lightpulsating, transparency, visual effects, etc., of a three-dimensionalshape.

In an embodiment, the three-dimensional environment comprises a secondthree-dimensional object having a second attribute to which a second setof time-dependent data values of a second data field is mapped; thefirst view of the three-dimensional environment comprises a visibleappearance of the second three-dimensional object at the first time,while the second view of the three-dimensional environment comprises avisible appearance of the second three-dimensional object at the secondtime.

In an embodiment, the three-dimensional object comprises a secondattribute to which a second set of time-dependent data values of asecond data field is mapped; the second attribute of thethree-dimensional object is visible at one or more of the first view ofthe three-dimensional environment at the first time or the second viewof the three-dimensional environment at the second time.

In an embodiment in which the user is represented in thethree-dimensional environment with a virtual camera located at the firstlocation with the first perspective at the first time, the data displayserver is further configured to perform: determining, based on the userinput, a corresponding movement of the virtual camera in thethree-dimensional environment; and in response to determining thecorresponding movement of the virtual camera, moving the virtual camerain the three-dimensional environment to be located at the secondlocation with the second perspective at the second time.

In an embodiment, the data display server is further configured toperform: generating a three-dimensional clustering object in thethree-dimensional environment, wherein the three-dimensional clusteringobject includes a portion of each of one or more three-dimensionalobjects that include the three-dimensional object; and causing thethree-dimensional clustering object to be rendered in at least one ofthe first view of the three-dimensional environment at the first time orthe second view of the three-dimensional environment at the second time.

In an embodiment, the data display server is further configured toperform: generating a three-dimensional clustering object in thethree-dimensional environment, wherein the three-dimensional clusteringobject includes a portion of each of one or more three-dimensionalobjects that include the three-dimensional object; and causing thethree-dimensional clustering object to be rendered in a prior view ofthe three-dimensional environment relative to a prior location and aprior perspective of the user at a prior time before the first time, thethree-dimensional object not being rendered in the prior view of thethree-dimensional environment, and wherein the first view is rendered inresponse to receiving prior user input that selects thethree-dimensional clustering object between the prior time and the firsttime.

In an embodiment, the data display server is further configured toperform: generating a first-level three-dimensional clustering object inthe three-dimensional environment, the first-level three-dimensionalclustering object including a portion of each of one or morethree-dimensional objects that include the three-dimensional object;generating a second-level three-dimensional clustering object in thethree-dimensional environment, the second-level three-dimensionalclustering object including a portion of the three-dimensionalclustering object and at least a portion of another three-dimensionalclustering object or another three-dimensional object; and causing thesecond-level three-dimensional clustering object to be rendered in aclustering view of the three-dimensional environment relative to aspecific location and a specific perspective of the user at a specifictime.

In an embodiment, the data display server is further configured toperform: generating a three-dimensional clustering object in thethree-dimensional environment, the three-dimensional clustering objecthaving at least a portion of each of two or more three-dimensionalobjects that include the three-dimensional object, the two or morethree-dimensional objects comprising two or more visual stateindicators, and each of the two or more three-dimensional objectscomprising a respective visual state indicator in the two or more visualstate indicators; and causing the three-dimensional clustering object tobe rendered with a visual state indicator in a clustering view of thethree-dimensional environment relative to a specific location and aspecific perspective of the user at a specific time, the visual stateindicator of the three-dimensional clustering object being selected tobe the same as a specific visual state indicator of a specificthree-dimensional object in the two or more visual state indicators ofthe two or more three-dimensional objects.

In an embodiment, one or more of first-level three-dimensionalclustering objects, second-level three-dimensional objects, or n-thlevel three-dimensional objects are visible in at least one of the firstview of the three-dimensional environment at the first time or thesecond view of the three-dimensional environment at the second time,where n is a positive integer greater than zero.

In an embodiment, the data field as mentioned above is a data field of adata object representing a real-world component; a time-dependent stateof the real-world component is determined based at least in part on theset of time-dependent data values of the data field. In an embodiment,the real-world component represents one or more of cloud-based clusteredsystems, cloud-based data centers, host clusters, hosts, virtualmachines, computing processors, computing processes, etc. In anembodiment, the time-dependent state of the real-world component at agiven time represents a specific state that is selected, based at leastin part on the set of time-dependent values at the given time, from afinite number of discrete states of a specific type. In an embodiment,the time-dependent state of the real-world component represents aspecific type of state among a finite number of types of state.

In an embodiment, the data display server is further configured toperform: recording a trajectory of the user as represented in thethree-dimensional environment for a time interval, the time intervalincluding both the first time and the second time, the trajectorycomprising the first location and the first perspective of the user atthe first time and the second location and the second perspective of theuser at the second time; and causing a plurality of views of thethree-dimensional environment to be rendered based on the recordedtrajectory of the user in a replaying of the trajectory of the user, theplurality of views comprising the first view of the three-dimensionalenvironment as rendered at the first time and the second view of thethree-dimensional environment as rendered at the second time.

In an embodiment, the data display server is further configured toperform: recording a plurality of views of the three-dimensionalenvironment displayed to the user for a time interval, the time intervalincluding both the first time and the second time; and causing theplurality of views of the three-dimensional environment to be renderedin a replaying of the plurality of views, the plurality of viewscomprising the first view of the three-dimensional environment asrendered at the first time and the second view of the three-dimensionalenvironment as rendered at the second time.

In an embodiment in which the set of time-dependent values of the datafield is a part of input data mapped to attributes of one or more ofthree-dimensional objects or three-dimensional clustering objectsrepresented in the three-dimensional environment, the data displayserver is further configured to perform: recording a specific portion ofthe input data corresponding to a specific time interval, the specifictime interval including both the first time and the second time; andcausing a plurality of views of the three-dimensional environment to berendered in a re-exploration of the specific portion of the input data,the plurality of views in the re-exploration of the specific portion ofthe input data comprising one or more of same views of thethree-dimensional environment as rendered in the specific time interval,or at least one different view replacing at least one of the same viewsof the three-dimensional environment.

In an embodiment, the three-dimensional environment comprises one ormore of contiguous spatial portions or non-contiguous spatial portions.

In an embodiment, the data display server is further configured toperform: while the first view of the three-dimensional environment isbeing rendered on a first display device to the user at the first time,causing the first view of the three-dimensional environment to berendered on a second display device to a second user at the first time.

In an embodiment, the data display server is further configured toperform: while the first view of the three-dimensional environment isbeing rendered on a first display device to the user at the first time,causing a different view, other than the first view, of thethree-dimensional environment to be rendered on a second display deviceto a second user at the first time, the different view being a view—ofthe three dimensional environment—relative to a different location and adifferent perspective of the second user as represented in the threedimensional environment.

In an embodiment, the three-dimensional environment is dynamicallygenerated based on a single user command that specifies a set of one ormore relationships each of which is one of a relationship between a datafield and an attribute of one of one or more three-dimensional objectsrepresented by the three-dimensional environment.

In an embodiment, the three-dimensional environment is dynamicallysuperimposed with a portion of a real-world three-dimensionalenvironment in which the user moves; the user input is generated throughone or more sensors configured to track the user's motion.

In an embodiment, the data display server is further configured toperform: receiving second user input that specifies an action to beperformed with a component relating to one or more attributes of one ormore three-dimensional objects represented in the three-dimensionalenvironment; and causing the action to be performed on the component.

In an embodiment, the data display server is further configured toperform: receiving second user input that specifies attaching a specificmarker to the three-dimensional object; and causing the specific markerto be attached to the three-dimensional object as represented in thethree-dimensional environment.

Embodiments include a system that, according to various embodiments,comprises a processor and memory and is adapted for: (1) receiving afirst set of data that includes at least a value of a first variabletaken over time; (2) receiving a second set of data that includes atleast a value of a second variable taken over time; (3) mapping, by atleast one processor, the value of the first variable to a particularattribute of a first three dimensional object so that the particularattribute of the first three dimensional object changes over time tocorrespond to changes in the first particular variable; (4) mapping, byat least one processor, the value of the second variable to a particularattribute of a second three dimensional object in real time so that theparticular attribute of the second three dimensional object changes overtime to correspond to changes in the second particular variable; (5)allowing a user to view the first and second three dimensional objectsfrom a first person perspective by: (a) using at least one processor tofacilitate allowing the user to dynamically move a virtual camera, inthree dimensions, relative to the first and second three dimensionalobjects as the respective particular attributes of the first and secondthree dimensional objects change over time to reflect changing values ofthe first and second particular variables; and (b) displaying the firstand second three dimensional objects to the user from the perspective ofthe virtual camera as the camera moves relative to the first and secondthree dimensional objects.

In an embodiment, an apparatus comprises a processor and is configuredto perform any of the foregoing methods.

In an embodiment, a non-transitory computer readable storage medium,storing software instructions, which when executed by one or moreprocessors cause performance of any of the foregoing methods.

In an embodiment, a computing device comprising one or more processorsand one or more storage media storing a set of instructions which, whenexecuted by the one or more processors, cause performance of any of theforegoing methods. Note that, although separate embodiments arediscussed herein, any combination of embodiments and/or partialembodiments discussed herein may be combined to form furtherembodiments.

19. Example System Architecture

FIG. 11 illustrates a diagrammatic representation of a computerarchitecture 1100 that can be used within the System 100, for example,as a client computer (e.g., one of the computing devices 120, 130 shownin FIG. 1, etc.), or as a server computer (e.g., Data Display Server 100shown in FIG. 1, etc.). In particular embodiments, the computer 1100 maybe suitable for use as a computer within the context of the System 100that is configured to facilitate various data display methodologiesdescribed above.

In particular embodiments, the computer 1100 may be connected (e.g.,networked, etc.) to other computers in a LAN, an intranet, an extranet,and/or the Internet. As noted above, the computer 1100 may operate inthe capacity of a server or a client computer in a client-server networkenvironment, or as a peer computer in a peer-to-peer (or distributed)network environment. The Computer 920 may be a desktop personal computer(PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant(PDA), a cellular telephone, a web appliance, a server, a networkrouter, a switch or bridge, or any other computer capable of executing aset of instructions (sequential or otherwise) that specify actions to betaken by that computer. Further, while only a single computer isillustrated, the term “computer” shall also be taken to include anycollection of computers that individually or jointly execute a set (ormultiple sets) of instructions to perform any one or more of themethodologies discussed herein.

An example computer 1100 includes a processing device 1102, a mainmemory 1104 (e.g., read-only memory (ROM), flash memory, dynamic randomaccess memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM(RDRAM), etc.), a static memory 106 (e.g., flash memory, static randomaccess memory (SRAM), etc.), and a data storage device 1118, whichcommunicate with each other via a bus 1132.

The processing device 1102 represents one or more general-purposeprocessing devices such as a microprocessor, a central processing unit,or the like. More particularly, the processing device 1102 may be acomplex instruction set computing (CISC) microprocessor, reducedinstruction set computing (RISC) microprocessor, very long instructionword (VLIW) microprocessor, or processor implementing other instructionsets, or processors implementing a combination of instruction sets. Theprocessing device 1102 may also be one or more special-purposeprocessing devices such as an application specific integrated circuit(ASIC), a field programmable gate array (FPGA), a digital signalprocessor (DSP), network processor, or the like. The processing device1102 may be configured to execute processing logic 1126 for performingvarious operations and steps discussed herein.

The computer 1100 may further include a network interface device 1108.The computer 1100 also may include a video display unit 1110 (e.g., aliquid crystal display (LCD) or a cathode ray tube (CRT), etc.), analphanumeric input device 1112 (e.g., a keyboard, etc.), a cursorcontrol device 1114 (e.g., a mouse, etc.), a signal generation device1116 (e.g., a speaker, etc.), etc.

The data storage device 1118 may include a non-transitorycomputer-accessible storage medium 1130 (also known as a non-transitorycomputer-readable storage medium or a non-transitory computer-readablemedium) on which is stored one or more sets of instructions (e.g.,software 1122, etc.) embodying any one or more of the methodologies orfunctions described herein. The software 1122 may also reside,completely or at least partially, within the main memory 1104 and/orwithin the processing device 1102 during execution thereof by thecomputer 1100—the main memory 1104 and the processing device 1102 alsoconstituting computer-accessible storage media. The software 1122 mayfurther be transmitted or received over a network 1115 via a networkinterface device 1108.

While the computer-accessible storage medium 1130 is shown in an exampleembodiment to be a single medium, the term “computer-accessible storagemedium” should be understood to include a single medium or multiplemedia (e.g., a centralized or distributed database, and/or associatedcaches and servers, etc.) that store the one or more sets ofinstructions. The term “computer-accessible storage medium” should alsobe understood to include any medium that is capable of storing, encodingor carrying a set of instructions for execution by the computer and thatcause the computer to perform any one or more of the methodologies ofthe present invention. The term “computer-accessible storage medium”should accordingly be understood to include, but not be limited to,solid-state memories, optical and magnetic media, etc.

20. Equivalents, Extensions, Alternatives and Miscellaneous

In the foregoing specification, embodiments of the invention have beendescribed with reference to numerous specific details that may vary fromimplementation to implementation. Thus, the sole and exclusive indicatorof what is the invention, and is intended by the applicants to be theinvention, is the set of claims that issue from this application, in thespecific form in which such claims issue, including any subsequentcorrection. Any definitions expressly set forth herein for termscontained in such claims shall govern the meaning of such terms as usedin the claims. Hence, no limitation, element, property, feature,advantage or attribute that is not expressly recited in a claim shouldlimit the scope of such claim in any way. The specification and drawingsare, accordingly, to be regarded in an illustrative rather than arestrictive sense.

What is claimed is:
 1. A computer-implemented method, comprising:receiving data from an external data source, wherein the data comprisesreal-time machine data that reflects activity within an informationtechnology environment; generating a three-dimensional model thatincludes a first plurality of three-dimensional objects, wherein eachthree-dimensional object included in the first plurality ofthree-dimensional objects has multiple attributes and a state derivedfrom at least one aspect of the data, and each of the multipleattributes of the first three-dimensional object is mapped to one ormore different aspects of the real-time machine data; generating a firstclustering object within the three-dimensional model, wherein the firstclustering object encompasses the first plurality of three-dimensionalobjects; determining a first state associated with a firstthree-dimensional object included in the first plurality ofthree-dimensional objects, wherein the first state comprises a variablealert state having one of at least three alert states, and wherein thefirst state is determined based on at least one aspect of the real-timemachine data mapped to the first three-dimensional object and anycorresponding aspects inherited from one or more lower levelhierarchical components associated with the at least one firstthree-dimensional object; determining a second state associated with asecond three-dimensional object included in the plurality ofthree-dimensional objects, wherein the second state comprises a variablealert state having one of at least three alert states, and wherein thesecond state determination is based on at least one aspect of real-timemachine data mapped to the second three dimensional object and at leastone corresponding aspect inherited from one or more lower levelhierarchical components associated with the at least one secondthree-dimensional object, wherein the first and second three-dimensionalobject are different three-dimensional objects within the plurality ofthree-dimensional objects; determining a clustering object alert levelassociated with the first clustering object based on a comparisonbetween the alert state associated with the first state and the alertstate associated with the second state, wherein the alert levelcomprises one of at least three alert states, and wherein the firstclustering object inherits the alert state from each of the firstthree-dimensional object and the second three-dimensional object;selecting a cluster state associated with the first clustering objectbased on the clustering object alert level, wherein the cluster statecauses a visual aspect of the first clustering object to change as thecluster state changes, wherein the visual aspect is different for eachof the at least three alert states; and displaying a first portion ofthe three-dimensional model that includes the first clustering objectand a graphical representation of the cluster state.
 2. The method ofclaim 1, wherein selecting the cluster state is further based on thefirst state indicating a higher alert state relative to the secondstate.
 3. The method of claim 1, wherein the first state is selected asthe cluster state based on the first graphical object representing afirst component within the information technology environment having ahigher priority than a priority associated with a second componentwithin the information technology infrastructure represented by thesecond graphical object.
 4. The method of claim 1, wherein the change inthe visual aspect of the first clustering object comprises beaconing orpulsating clustering object beacons or pulsates with a first frequencyas the first state of the first three-dimensional object comprises afirst alert state and beaconing or pulsating with a second frequency asthe first state of the first three-dimensional object comprises a secondalert state.
 5. The method of claim 1, wherein the three-dimensionalmodel includes a second plurality of three-dimensional objects, whereineach three-dimensional object included in the second plurality ofthree-dimensional objects has multiple attributes and a state derivedfrom at least one aspect of the data, and further comprising: generatinga second clustering object within the three-dimensional model, whereinthe second clustering object encompasses the second plurality ofthree-dimensional objects and has a state derived from the statesassociated with the second plurality of three-dimensional objects; anddisplaying a second portion of the three-dimensional model that includesthe second clustering object.
 6. The method of claim 1, wherein thethree-dimensional model includes a second plurality of three-dimensionalobjects, wherein each three-dimensional object included in the secondplurality of three-dimensional objects has multiple attributes and astate derived from at least one aspect of the data, and furthercomprising: generating a second clustering object within thethree-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; generating a third clustering object withinthe three dimensional model, wherein the third clustering objectencompasses the first clustering object and the second clustering objectand has a state derived from the clustering state of the firstclustering object and the state of the second clustering object; anddisplaying a third portion of the three-dimensional model that includesthe third clustering object.
 7. The method of claim 1, wherein thethree-dimensional model includes a second plurality of three-dimensionalobjects, wherein each three-dimensional object included in the secondplurality of three-dimensional objects has multiple attributes and astate derived from at least one aspect of the data, and furthercomprising: generating a second clustering object within thethree-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; generating a third clustering object withinthe three dimensional model, wherein the third clustering objectencompasses the first clustering object and the second clustering objectand has a state derived from the clustering state of the firstclustering object and the state of the second clustering object; anddisplaying a third portion of the three-dimensional model that includesthe third clustering object, wherein the third clustering objectrepresents a data center, the first clustering object represents a firstsever machine within the data center, the second clustering objectrepresents a second server machine within the data center.
 8. The methodof claim 1, wherein the three-dimensional model includes a secondplurality of three-dimensional objects, wherein each three-dimensionalobject included in the second plurality of three-dimensional objects hasmultiple attributes and a state derived from at least one aspect of thedata, and further comprising: generating a second clustering objectwithin the three-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; generating a third clustering object withinthe three dimensional model, wherein the third clustering objectencompasses the first clustering object and the second clustering objectand has a state derived from the clustering state of the firstclustering object and the state of the second clustering object; anddisplaying a third portion of the three-dimensional model that includesthe third clustering object, wherein the third clustering objectrepresents a data center, the first clustering object represents a firstsever machine within the data center, the second clustering objectrepresents a second server machine within the data center, the firstplurality of three-dimensional objects represent different processors orvirtual machines executing within the first server machine, and thesecond plurality of three-dimensional objects represent differentprocessors or virtual machines executing within the second servermachine.
 9. The method of claim 1, wherein the real-time machine data isgenerated by at least one of a server machine, a processor, and avirtual machine.
 10. The method of claim 1, wherein the real-timemachine data is generated by at least one of a server machine, aprocessor, and a virtual machine, and each of the multiple attributes ofthe first three-dimensional object is mapped to different aspects of thereal-time machine data.
 11. A non-transitory computer-readable mediumincluding instructions that, when executed by a processor, cause theprocessor to perform the steps of: receiving data from an external datasource, wherein the data comprises real-time machine data that reflectsactivity within an information technology environment; generating athree-dimensional model that includes a first plurality ofthree-dimensional objects, wherein each three-dimensional objectincluded in the first plurality of three-dimensional objects hasmultiple attributes and a state derived from at least one aspect of thedata, and each of the multiple attributes of the first three-dimensionalobject is mapped to one or more different aspects of the real-timemachine data; generating a first clustering object within thethree-dimensional model, wherein the first clustering object encompassesthe first plurality of three-dimensional objects; determining a firststate associated with a first three-dimensional object included in thefirst plurality of three-dimensional objects, wherein the first statecomprises a variable alert state having one of at least three alertstates, and wherein the first state is determined based on at least oneaspect of the real-time machine data mapped to the firstthree-dimensional object and any corresponding aspects inherited fromone or more lower level hierarchical components associated with the atleast one first three-dimensional object; determining a second stateassociated with a second three-dimensional object included in theplurality of three-dimensional objects, wherein the second statecomprises a variable alert state having one of at least three alertstates, and wherein the second state determination is based on at leastone aspect of real-time machine data mapped to the second threedimensional object and at least one corresponding aspect inherited fromone or more lower level hierarchical components associated with the atleast one second three-dimensional object, wherein the first and secondthree-dimensional object are different three-dimensional objects withinthe plurality of three-dimensional objects; determining a clusteringobject alert level associated with the first clustering object based ona comparison between the alert state associated with the first state andthe alert state associated with the second state, wherein the alertlevel comprises one of at least three alert states, and wherein thefirst clustering object inherits the alert state from each of the firstthree-dimensional object and the second three-dimensional object;selecting a cluster state associated with the first clustering objectbased on the clustering object alert level, wherein the cluster statecauses a visual aspect of the first clustering object to change as thecluster state changes, wherein the visual aspect is different for eachof the at least three alert states; and displaying a first portion ofthe three-dimensional model that includes the first clustering objectand a graphical representation of the cluster state.
 12. Thenon-transitory computer-readable medium of claim 11, wherein selectingthe cluster state is further based on the first state indicating ahigher alert state relative to the second state.
 13. The non-transitorycomputer-readable medium of claim 11, wherein the first state isselected as the cluster state based on the first graphical objectrepresenting a first component within the information technologyenvironment having a higher priority than a priority associated with asecond component within the information technology infrastructurerepresented by the second graphical object.
 14. The non-transitorycomputer-readable medium of claim 11, wherein the change in the visualaspect of the first clustering object comprises beaconing or pulsatingclustering object beacons or pulsates with a first frequency as thefirst state of the first three-dimensional object comprises a firstalert state and beaconing or pulsating with a second frequency as thefirst state of the first three-dimensional object comprises a secondalert state.
 15. The non-transitory computer-readable medium of claim11, wherein the three-dimensional model includes a second plurality ofthree-dimensional objects, wherein each three-dimensional objectincluded in the second plurality of three-dimensional objects hasmultiple attributes and a state derived from at least one aspect of thedata, and further comprising: generating a second clustering objectwithin the three-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; and displaying a second portion of thethree-dimensional model that includes the second clustering object. 16.The non-transitory computer-readable medium of claim 11, wherein thethree-dimensional model includes a second plurality of three-dimensionalobjects, wherein each three-dimensional object included in the secondplurality of three-dimensional objects has multiple attributes and astate derived from at least one aspect of the data, and furthercomprising: generating a second clustering object within thethree-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; generating a third clustering object withinthe three dimensional model, wherein the third clustering objectencompasses the first clustering object and the second clustering objectand has a state derived from the clustering state of the firstclustering object and the state of the second clustering object; anddisplaying a third portion of the three-dimensional model that includesthe third clustering object.
 17. The non-transitory computer-readablemedium of claim 11, wherein the three-dimensional model includes asecond plurality of three-dimensional objects, wherein eachthree-dimensional object included in the second plurality ofthree-dimensional objects has multiple attributes and a state derivedfrom at least one aspect of the data, and further comprising: generatinga second clustering object within the three-dimensional model, whereinthe second clustering object encompasses the second plurality ofthree-dimensional objects and has a state derived from the statesassociated with the second plurality of three-dimensional objects;generating a third clustering object within the three dimensional model,wherein the third clustering object encompasses the first clusteringobject and the second clustering object and has a state derived from theclustering state of the first clustering object and the state of thesecond clustering object; and displaying a third portion of thethree-dimensional model that includes the third clustering object,wherein the third clustering object represents a data center, the firstclustering object represents a first sever machine within the datacenter, the second clustering object represents a second server machinewithin the data center.
 18. The non-transitory computer-readable mediumof claim 11, wherein the three-dimensional model includes a secondplurality of three-dimensional objects, wherein each three-dimensionalobject included in the second plurality of three-dimensional objects hasmultiple attributes and a state derived from at least one aspect of thedata, and further comprising: generating a second clustering objectwithin the three-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; generating a third clustering object withinthe three dimensional model, wherein the third clustering objectencompasses the first clustering object and the second clustering objectand has a state derived from the clustering state of the firstclustering object and the state of the second clustering object; anddisplaying a third portion of the three-dimensional model that includesthe third clustering object, wherein the third clustering objectrepresents a data center, the first clustering object represents a firstsever machine within the data center, the second clustering objectrepresents a second server machine within the data center, the firstplurality of three-dimensional objects represent different processors orvirtual machines executing within the first server machine, and thesecond plurality of three-dimensional objects represent differentprocessors or virtual machines executing within the second servermachine.
 19. The non-transitory computer-readable medium of claim 11,wherein the real-time machine data is generated by at least one of aserver machine, a processor, and a virtual machine.
 20. Thenon-transitory computer-readable medium of claim 11, wherein thereal-time machine data is generated by at least one of a server machine,a processor, and a virtual machine, and each of the multiple attributesof the first three-dimensional object is mapped to different aspects ofthe real-time machine data.
 21. A computer system, comprising: a memorythat includes instructions; and a processor that is coupled to thememory and, when executing the instructions, is configured to performthe steps of: receiving data from an external data source, wherein thedata comprises real-time machine data that reflects activity within aninformation technology environment; generating a three-dimensional modelthat includes a first plurality of three-dimensional objects, whereineach three-dimensional object included in the first plurality ofthree-dimensional objects has multiple attributes and a state derivedfrom at least one aspect of the data, and each of the multipleattributes of the first three-dimensional object is mapped to one ormore different aspects of the real-time machine data; generating a firstclustering object within the three-dimensional model, wherein the firstclustering object encompasses the first plurality of three-dimensionalobjects; determining a first state associated with a firstthree-dimensional object included in the first plurality ofthree-dimensional objects, wherein the first state comprises a variablealert state having one of at least three alert states, and wherein thefirst state is determined based on at least one aspect of the real-timemachine data mapped to the first three-dimensional object and anycorresponding aspects inherited from one or more lower levelhierarchical components associated with the at least one firstthree-dimensional object; determining a second state associated with asecond three-dimensional object included in the plurality ofthree-dimensional objects, wherein the second state comprises a variablealert state having one of at least three alert states, and wherein thesecond state determination is based on at least one aspect of real-timemachine data mapped to the second three dimensional object and at leastone corresponding aspect inherited from one or more lower levelhierarchical components associated with the at least one secondthree-dimensional object, wherein the first and second three-dimensionalobject are different three-dimensional objects within the plurality ofthree-dimensional objects; determining a clustering object alert levelassociated with the first clustering object based on a comparisonbetween the alert state associated with the first state and the alertstate associated with the second state, wherein the alert levelcomprises one of at least three alert states, and wherein the firstclustering object inherits the alert state from each of the firstthree-dimensional object and the second three-dimensional object;selecting a cluster state associated with the first clustering objectbased on the clustering object alert level, wherein the cluster statecauses a visual aspect of the first clustering object to change as thecluster state changes, wherein the visual aspect is different for eachof the at least three alert states; and displaying a first portion ofthe three-dimensional model that includes the first clustering objectand a graphical representation of the cluster state.
 22. The computersystem of claim 21, wherein selecting the cluster state is further basedon the first state indicating a higher alert state relative to thesecond state.
 23. The computer system of claim 21, wherein the firststate is selected as the cluster state based on the first graphicalobject representing a first component within the information technologyenvironment having a higher priority than a priority associated with asecond component within the information technology infrastructurerepresented by the second graphical object.
 24. The computer system ofclaim 21, wherein the change in the visual aspect of the firstclustering object comprises beaconing or pulsating clustering objectbeacons or pulsates with a first frequency as the first state of thefirst three-dimensional object comprises a first alert state andbeaconing or pulsating with a second frequency as the first state of thefirst three-dimensional object comprises a second alert state.
 25. Thecomputer system of claim 21, wherein the three-dimensional modelincludes a second plurality of three-dimensional objects, wherein eachthree-dimensional object included in the second plurality ofthree-dimensional objects has multiple attributes and a state derivedfrom at least one aspect of the data, and further comprising: generatinga second clustering object within the three-dimensional model, whereinthe second clustering object encompasses the second plurality ofthree-dimensional objects and has a state derived from the statesassociated with the second plurality of three-dimensional objects; anddisplaying a second portion of the three-dimensional model that includesthe second clustering object.
 26. The computer system of claim 21,wherein the three-dimensional model includes a second plurality ofthree-dimensional objects, wherein each three-dimensional objectincluded in the second plurality of three-dimensional objects hasmultiple attributes and a state derived from at least one aspect of thedata, and further comprising: generating a second clustering objectwithin the three-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; generating a third clustering object withinthe three dimensional model, wherein the third clustering objectencompasses the first clustering object and the second clustering objectand has a state derived from the clustering state of the firstclustering object and the state of the second clustering object; anddisplaying a third portion of the three-dimensional model that includesthe third clustering object.
 27. The computer system of claim 21,wherein the three-dimensional model includes a second plurality ofthree-dimensional objects, wherein each three-dimensional objectincluded in the second plurality of three-dimensional objects hasmultiple attributes and a state derived from at least one aspect of thedata, and further comprising: generating a second clustering objectwithin the three-dimensional model, wherein the second clustering objectencompasses the second plurality of three-dimensional objects and has astate derived from the states associated with the second plurality ofthree-dimensional objects; generating a third clustering object withinthe three dimensional model, wherein the third clustering objectencompasses the first clustering object and the second clustering objectand has a state derived from the clustering state of the firstclustering object and the state of the second clustering object; anddisplaying a third portion of the three-dimensional model that includesthe third clustering object, wherein the third clustering objectrepresents a data center, the first clustering object represents a firstsever machine within the data center, the second clustering objectrepresents a second server machine within the data center.
 28. Thecomputer system of claim 21, wherein the three-dimensional modelincludes a second plurality of three-dimensional objects, wherein eachthree-dimensional object included in the second plurality ofthree-dimensional objects has multiple attributes and a state derivedfrom at least one aspect of the data, and further comprising: generatinga second clustering object within the three-dimensional model, whereinthe second clustering object encompasses the second plurality ofthree-dimensional objects and has a state derived from the statesassociated with the second plurality of three-dimensional objects;generating a third clustering object within the three dimensional model,wherein the third clustering object encompasses the first clusteringobject and the second clustering object and has a state derived from theclustering state of the first clustering object and the state of thesecond clustering object; and displaying a third portion of thethree-dimensional model that includes the third clustering object,wherein the third clustering object represents a data center, the firstclustering object represents a first sever machine within the datacenter, the second clustering object represents a second server machinewithin the data center, the first plurality of three-dimensional objectsrepresent different processors or virtual machines executing within thefirst server machine, and the second plurality of three-dimensionalobjects represent different processors or virtual machines executingwithin the second server machine.
 29. The computer system of claim 21,wherein the real-time machine data is generated by at least one of aserver machine, a processor, and a virtual machine.
 30. The computersystem of claim 21, wherein the real-time machine data is generated byat least one of a server machine, a processor, and a virtual machine,and each of the multiple attributes of the first three-dimensionalobject is mapped to different aspects of the real-time machine data.